查询AWS中共享VPC的目的账户

Question

在 AWS 中，我有一个定义所有 VPC 和子网的集中式网络帐户。每个 VPC 都使用资源访问管理器 (RAM) 与目标帐户共享。给定一个 IP，需要找出与 VPC/subnet 共享的目标帐户 ID。这是我到目前为止所做的：

在下面的代码中，vpc 参数包含 vpc 查找响应，ip_addr 是我们要查找的 IP 地址

def lookup_ipaddr (session, ec2_client, vpc, ip_addr):  
  found = False

  if (ipaddress.ip_address(ip_addr) in ipaddress.ip_network(vpc['CidrBlock'])):
    filters = [{'Name':'vpc-id', 'Values':[ vpc['VpcId'] ]}]

    subnets = ec2_client.describe_subnets( Filters = filters )['Subnets']

    for subnet in subnets:
      if (ipaddress.ip_address(ip_addr) in ipaddress.ip_network(subnet['CidrBlock'])):
        found = True

        tags = subnet['Tags']

        # tags returned by previous api is in different form than that required by RAM  
        for tag in tags:
          tag['tagKey'] = tag['Key']
          tag['tagValues'] = [tag['Value']]
          del tag['Key']
          del tag['Value']
 
        print("\n\n")
        print (tags)
        print("\n\n")

        resourceArn = subnet['SubnetArn']
        ram_client = session.client('ram')

        resp = ram_client.get_resource_shares (resourceOwner = 'SELF', tagFilters=tags)

但是 API 调用 get_resource_shares 没有 return 任何响应（响应元数据除外）。关于如何找到共享子网的目标帐户 ID/Principal 的任何建议？

Answer 1

经过一番挖掘，我能够使用 AWS Resource Access Manager (RAM) 的 list_principals api 获取目标账户 ID：https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ram.html#RAM.Client.list_principals

这是完整的 python 代码：

def lookup_ipaddr (session, ec2_client, vpc, ip_addr):  
  found = False

  filters = [{'Name':'vpc-id', 'Values':[ vpc['VpcId'] ]}]

  subnets = ec2_client.describe_subnets( Filters = filters )['Subnets']

  for subnet in subnets:
    if (ipaddress.ip_address(ip_addr) in ipaddress.ip_network(subnet['CidrBlock'])):
      resourceArn = subnet['SubnetArn']
      ram_client = session.client('ram')

      resp = ram_client.list_principals(
        resourceOwner = 'SELF',
        resourceArn = resourceArn
      )

      print(f"Subnet {subnet['SubnetId']} is shared with account [{resp['principals'][0]['id']}]")
      found = True
      break
  return found

查询AWS中共享VPC的目的账户

Query destination account to which a VPC is shared in AWS

python

ram

resourcemanager

amazon-web-services