我正在使用下面的 python 代碼列出所有 IAM 角色名稱。
from boto3 import Session
import logging
from botocore.exceptions import ClientError
logger = logging.getLogger(__name__)
def list_iam_roles(profile):
boto_sess = Session(profile_name=profile)
client = boto_sess.client('iam')
roles = client.list_roles()
for role in roles["Roles"]:
print (role["RoleName"])
return
list_iam_roles('some_profile')
它成功回傳了所有 IAM 角色名稱的串列，但我的要求是根據特定的 AssumeRolePolicyDocument 進行過濾。
我想過濾具有Action: sts:AssumeRoleWithSAML.
任何提示我如何過濾它？
每個角色的示例輸出粘貼在下面。已經用 xxx 加密了一些重要資訊。
{'Path': '/', 'RoleName': 'some_role_name', 'RoleId': 'some_id', 'Arn': 'arn:aws:iam::xxxxx:role/some_role_name', 'CreateDate': datetime.datetime(2021, 2, 14, 12, 49, 26, tzinfo=tzutc()), 'AssumeRolePolicyDocument': {'Version': '2012-10-17', 'Statement': [{'Sid': '', 'Effect': 'Allow', 'Principal': {'Federated': 'arn:aws:iam::xxxxx:saml-provider/provider_name'}, 'Action': 'sts:AssumeRoleWithSAML', 'Condition': {'StringEquals': {'SAML:aud': 'https://signin.aws.amazon.com/saml'}}}]}, 'MaxSessionDuration': 36000}
uj5u.com熱心網友回復：
還有另一個稍微更明確的檢查。只檢查一個字串可能就足夠了。
roles = [
{
"Path": "/",
"RoleName": "some_role_name",
"RoleId": "some_id",
"Arn": "arn:aws:iam::xxxxx:role/some_role_name",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::xxxxx:saml-provider/provider_name"
},
"Action": "sts:AssumeRoleWithSAML",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
},
}
],
},
"MaxSessionDuration": 36000,
},
{
"Path": "/",
"RoleName": "some_other_role_name",
"RoleId": "some_other_id",
"Arn": "arn:aws:iam::xxxxx:role/some_other_role_name",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::xxxxx:saml-provider/provider_name"
},
"Action": "not:theActionYoureLookingFor",
}
],
},
"MaxSessionDuration": 36000,
},
]
filtered = set()
for r in roles:
for s in r.get("AssumeRolePolicyDocument", {}).get("Statement", []):
actions = s.get("Action", [])
for a in actions if isinstance(actions, list) else [actions]:
if "sts:AssumeRoleWithSAML" in a:
filtered.add(r.get("RoleName"))
print(filtered)
輸出：
{'some_role_name'}
在您的函式的背景關系中，這將是：
def list_iam_roles(profile):
filtered = set()
for r in Session(profile_name=profile).client("iam").list_roles().get("Roles", []):
for s in r.get("AssumeRolePolicyDocument", {}).get("Statement", []):
actions = s.get("Action", [])
for a in actions if isinstance(actions, list) else [actions]:
if "sts:AssumeRoleWithSAML" in a:
filtered.add(r.get("RoleName"))
return list(filtered)
肯定有一個非常討厭的理解可以做到這一點，但這應該很清楚，并且處理可以是字串或串列的策略值。
uj5u.com熱心網友回復：
一種方法是簡單地將您轉換role為字串并進行字串搜索：
def list_iam_roles(profile):
boto_sess = Session(profile_name=profile)
client = boto_sess.client('iam')
roles = client.list_roles()
for role in roles["Roles"]:
if "sts:AssumeRoleWithSAML".lower() in str(role).lower():
print (role["RoleName"])
return
轉載請註明出處，本文鏈接：https://www.uj5u.com/caozuo/464907.html
標籤：Python python-3.x 亚马逊网络服务 博托3 亚马逊