Set‑ShpRedactionPolicy

SYNOPSIS

Adds custom secret-redaction rules on top of the built-in patterns.

SYNTAX

Environment (Default)

Set-ShpRedactionPolicy -SecretEnvironmentVariable <String[]> [-WhatIf]
 [-Confirm] [<CommonParameters>]

Rule

Set-ShpRedactionPolicy [-Rule] <String[]> [-SecretEnvironmentVariable <String[]>]
 [-WhatIf] [-Confirm] [<CommonParameters>]

Path

Set-ShpRedactionPolicy -Path <String> [-SecretEnvironmentVariable <String[]>]
 [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION

Defines an additional rule set that Protect-ShpEgressContent applies together with the module's built-in patterns (GitHub tokens, AWS access key ids, PEM private-key blocks, JWTs, basic-auth URL credentials, and connection-string password fields) before any request leaves the runner. The built-ins are always active - this cmdlet only adds MORE patterns for a secret shape specific to your own environment; there is no rule to disable a single built-in short of Invoke-Shp -DisableRedaction, which turns off the whole control for that call.

A rule is Name(RegexPattern) - a name, and a .NET regular expression in parentheses - after the Kind(argument) shape Set-ShpToolPolicy already uses, so the two policies read the same way. A match is replaced with [redacted:], so choose a Name that will mean something to whoever reads the redacted transcript later.

Parsing (and compiling every regex) fails closed: a rule that does not match the Name(Pattern) shape, or whose pattern does not compile, throws and the previous policy is left in place, so a typo can never silently leave a secret unredacted while looking like the policy is active.

EXAMPLES

EXAMPLE 1

Set-ShpRedactionPolicy -SecretEnvironmentVariable DATABASE_PASSWORD

Redacts the current literal value without storing or reporting it.

EXAMPLE 2

Set-ShpRedactionPolicy -Rule 'InternalToken(itk_[A-Za-z0-9]{20,})'

Adds one custom pattern; a match is replaced with [redacted:InternalToken]. The six built-in patterns still apply too.

EXAMPLE 3

Set-ShpRedactionPolicy -Path ./redaction-policy.txt

Loads additional rules from a file you have chosen to trust.

PARAMETERS

-Path

A file to read the rules from, one per line; blank lines and lines starting with # are ignored. The file is read only because you named it here - no policy file is ever discovered automatically, because a file picked up from the working directory would let whoever can write there decide what this session redacts.

Type: String
Parameter Sets: Path
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Rule

The rules to apply, replacing any current custom policy. Each is Name(RegexPattern), for example 'InternalToken(itk_[A-Za-z0-9]{20,})'.

Type: String[]
Parameter Sets: Rule
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-SecretEnvironmentVariable

Names of environment variables whose current values must be redacted literally. Stored as names only and resolved for every outbound request and Event record, including batch workers. Unset or empty values add no match; nonempty values shorter than 8 characters are refused to prevent broad accidental replacement. Placeholders are [redacted:env-NAME]. Can be used alone or combined with Rule or Path; replaces the current custom policy. Values are never included in policy or match reports.

Type: String[]
Parameter Sets: Environment
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

Type: String[]
Parameter Sets: Rule, Path
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

None.

NOTES

RELATED LINKS

Get-ShpRedactionPolicy

Clear-ShpRedactionPolicy

Invoke-Shp