使用 Python / Boto3 打印 IAM 组策略 JSON 文档

Question

目标：

您好，我是一个新手，我正在尝试编写代码以从 IAM 组中提取内联策略文档，然后打印 JSON 文档。

---

我发现了一些类似的帖子，但没有成功引用它们：

• List of all roles with attached policies with Boto3
• How to get IAM Policy Document via boto

---

Boto3 文档：

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.get_group_policy

---

我收到以下错误：TypeError: Object of type function is not JSON serializable

---

import boto3
import json

iam = boto3.client('iam')

def get_group_policy(group_name, policy_name):

# Define variable:
group_name = 'aws_iam_group_name'
policy_name = 'aws_policy_arn'

# Retrieves inline policy document embedded in IMA group.
# Returns: GroupName, PolicyName, and PolicyDocument
response = iam.get_group_policy(
    GroupName = group_name,
    PolicyName = policy_name
)

return (json.dumps(group_name, policy_name))

# Calls and prints function
var1 = get_group_policy
print(json.dumps(var1))

---

我根据您所说的对代码进行了一些更新。以下是更改：

import boto3
import json

iam = boto3.client('iam')

# Define variable:
group_name = 'aws_iam_group_name'
policy_name = 'aws_policy_arn'

def get_group_policy(group_name, policy_name):

# Retrieves inline policy document embedded in IMA group.
# Returns: GroupName, PolicyName, and PolicyDocument
response = iam.get_group_policy(
    GroupName = group_name,
    PolicyName = policy_name
)

return (json.dumps(response))

# Calls and prints function
var1 = get_group_policy(group_name, policy_name)
#print(json.dumps(var1))
print(var1)

我收到以下错误：

    WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
WARNING: You are using pip version 21.2.4; however, version 21.3 is available.
You should consider upgrading via the '/usr/local/bin/python -m pip install --upgrade pip' command.
Traceback (most recent call last):
  File "/sso-iam/sso-iam/create-permission-set.py", line 32, in <module>
    var1 = get_group_policy(group_name, policy_name)
  File "/sso-iam/sso-iam/create-permission-set.py", line 24, in get_group_policy
    response = iam.get_group_policy(
  File "/usr/local/lib/python3.10/site-packages/botocore/client.py", line 388, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.10/site-packages/botocore/client.py", line 708, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (ValidationError) when calling the GetGroupPolicy operation: The specified value for policyName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_-

我不明白为什么它认为 PolicyName 不正确。我尝试直接从 AWS 复制 ARN，并且只使用 arn:aws:iam::#####:policy/itriedusingthispieceasPolicyName 之后的部分

Answer 1

你没有调用你的函数。您的 var1 实际上是函数对象，而不是它的结果。

应该是

group_name = 'aws_iam_group_name'
policy_name = 'aws_policy_arn' 
var1 = get_group_policy(group_name, policy_name) 

你也不需要函数中的名字，因为它们是它的参数。