用于在IAM策略中添加参数的函数

Question

我一直在编写一个boto脚本，用于从函数创建IAM用户策略。我想在策略中添加区域instance_type和ebs_volume限制。我希望输出为json格式。我不知道如何处理它。文件名为template_function.py这是的功能

def create_aws_iam_policy_template(**template):
print()
create_aws_iam_policy_template(region = "us-east-1", instance_type = "t2.micro", volume_size = "12")

这是存储在同一目录"中的另一个文件中的策略；metatemplate.py"；

import json 
import template_function
import boto3
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
f"arn:aws:ec2:{region}::instance/*",
f"arn:aws:ec2:{region}::network-interface/*",
f"arn:aws:ec2:{region}::key-pair/*",
f"arn:aws:ec2:{region}::security-group/*",
f"arn:aws:ec2:{region}::subnet/*",
f"arn:aws:ec2:{region}::volume/*",
f"arn:aws:ec2:{region}::image/ami-*"
],
"Condition": {
"ForAllValues:NumericLessThanEquals": {
"ec2:VolumeSize": f"{volume_size}"
},
"ForAllValues:StringEquals": {
"ec2:InstanceType": f"{instance_type}"
}
}
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances",
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": f"arn:aws:ec2:{region}::instance/*",
"Condition": {
"ForAllValues:StringEquals": {
"ec2:InstanceType": f"{region}"
}
}
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"ec2:Describe*",
"ec2:GetConsole*",
"cloudwatch:DescribeAlarms",
"iam:ListInstanceProfiles",
"cloudwatch:GetMetricStatistics",
"ec2:DescribeKeyPairs",
"ec2:CreateKeyPair"
],
"Resource": "*",
"Condition": {
"DateGreaterThan": {
"aws:CurrentTime": f"{start_time}"
},
"DateLessThanEquals": {
"aws:CurrentTime": f"{end_time}"
}
}
}
]
} 
response = iam.create_policy(
PolicyName='GoodPolicy',
PolicyDocument=json.dumps(some_policy)
)

Answer 1

创建一个Python对象，该对象的成员与您希望在JSON中看到的成员相同，然后在代码import json中调用json.dumps(your_python_object)。这将把你的对象变成一个JSON字符串。

然后调用create_policy API，并将从json.dumps获得的字符串作为PolicyDocument参数传入。

Answer 2

有多种方法可以做到这一点。下面是一个

import json
from jinja2 import Template
policy = '''
{  
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:{{region}}::instance/*",
"arn:aws:ec2:{{region}}::network-interface/*",
"arn:aws:ec2:{{region}}::key-pair/*",
"arn:aws:ec2:{{region}}::security-group/*",
"arn:aws:ec2:{{region}}::subnet/*",
"arn:aws:ec2:{{region}}::volume/*",
"arn:aws:ec2:{{region}}::image/ami-*"
],
"Condition": {
"ForAllValues:NumericLessThanEquals": {
"ec2:VolumeSize": "{{volume_size}}"
},
"ForAllValues:StringEquals": {
"ec2:InstanceType": "{{instance_type}}"
}
}
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances",
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "arn:aws:ec2:{{region}}::instance/*",
"Condition": {
"ForAllValues:StringEquals": {
"ec2:InstanceType": "{{region}}"
}
}
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"ec2:Describe*",
"ec2:GetConsole*",
"cloudwatch:DescribeAlarms",
"iam:ListInstanceProfiles",
"cloudwatch:GetMetricStatistics",
"ec2:DescribeKeyPairs",
"ec2:CreateKeyPair"
],
"Resource": "*",
"Condition": {
"DateGreaterThan": {
"aws:CurrentTime": "{{start_time}}"
},
"DateLessThanEquals": {
"aws:CurrentTime": "{{end_time}}"
}
}
}
]
}
'''
tm = Template(policy)
parsed_policy = tm.render(egion='us-east-1',start_time='1-2-3', end_time='3-4-5', volume_size='2', instance_type='t2.micro')
print(json.dumps(parsed_policy))