GetAccountAuthorizationDetails 사용하기
GetAccountAuthorizationDetails 사용하기 (SDK/CLI)
GetAccountAuthorizationDetails(계정 인증 세부 정보 조회) API를 활용하는 방법을 코드 예시로 정리했어요. 각 예시는 어떤 동작을 하는지, 어떤 파라미터를 쓰는지 순서대로 살펴볼 수 있어요.
출처: 문서
본문
다음 코드 예시들은 GetAccountAuthorizationDetails 를 어떻게 사용하는지 보여줘요.
AWS CLI
AWS 계정의 IAM 사용자·그룹·역할·정책 나열하기
aws iam get-account-authorization-details
다음 get-account-authorization-details 명령은 AWS 계정의 모든 IAM 사용자·그룹·역할·정책 정보를 반환해요.
{
"RoleDetailList": [
{
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"RoleId": "AROA1234567890EXAMPLE",
"CreateDate": "2014-07-30T17:09:20Z",
"InstanceProfileList": [
{
"InstanceProfileId": "AIPA1234567890EXAMPLE",
"Roles": [
{
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"RoleId": "AROA1234567890EXAMPLE",
"CreateDate": "2014-07-30T17:09:20Z",
"RoleName": "EC2role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/EC2role"
}
],
"CreateDate": "2014-07-30T17:09:20Z",
"InstanceProfileName": "EC2role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:instance-profile/EC2role"
}
],
"RoleName": "EC2role",
"Path": "/",
"AttachedManagedPolicies": [
{
"PolicyName": "AmazonS3FullAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess"
},
{
"PolicyName": "AmazonDynamoDBFullAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
}
],
"RoleLastUsed": {
"Region": "us-west-2",
"LastUsedDate": "2019-11-13T17:30:00Z"
},
"RolePolicyList": [],
"Arn": "arn:aws:iam::123456789012:role/EC2role"
}
],
"GroupDetailList": [
{
"GroupId": "AIDA1234567890EXAMPLE",
"AttachedManagedPolicies": {
"PolicyName": "AdministratorAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
},
"GroupName": "Admins",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:group/Admins",
"CreateDate": "2013-10-14T18:32:24Z",
"GroupPolicyList": []
},
{
"GroupId": "AIDA1234567890EXAMPLE",
"AttachedManagedPolicies": {
"PolicyName": "PowerUserAccess",
"PolicyArn": "arn:aws:iam::aws:policy/PowerUserAccess"
},
"GroupName": "Dev",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:group/Dev",
"CreateDate": "2013-10-14T18:33:55Z",
"GroupPolicyList": []
},
{
"GroupId": "AIDA1234567890EXAMPLE",
"AttachedManagedPolicies": [],
"GroupName": "Finance",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:group/Finance",
"CreateDate": "2013-10-14T18:57:48Z",
"GroupPolicyList": [
{
"PolicyName": "policygen-201310141157",
"PolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Action": "aws-portal:*",
"Sid": "Stmt1381777017000",
"Resource": "*",
"Effect": "Allow"
}
]
}
}
]
}
],
"UserDetailList": [
{
"UserName": "Alice",
"GroupList": [
"Admins"
],
"CreateDate": "2013-10-14T18:32:24Z",
"UserId": "AIDA1234567890EXAMPLE",
"UserPolicyList": [],
"Path": "/",
"AttachedManagedPolicies": [],
"Arn": "arn:aws:iam::123456789012:user/Alice"
},
{
"UserName": "Bob",
"GroupList": [
"Admins"
],
"CreateDate": "2013-10-14T18:32:25Z",
"UserId": "AIDA1234567890EXAMPLE",
"UserPolicyList": [
{
"PolicyName": "DenyBillingAndIAMPolicy",
"PolicyDocument": {
"Version":"2012-10-17",
"Statement": {
"Effect": "Deny",
"Action": [
"aws-portal:*",
"iam:*"
],
"Resource": "*"
}
}
}
],
"Path": "/",
"AttachedManagedPolicies": [],
"Arn": "arn:aws:iam::123456789012:user/Bob"
},
{
"UserName": "Charlie",
"GroupList": [
"Dev"
],
"CreateDate": "2013-10-14T18:33:56Z",
"UserId": "AIDA1234567890EXAMPLE",
"UserPolicyList": [],
"Path": "/",
"AttachedManagedPolicies": [],
"Arn": "arn:aws:iam::123456789012:user/Charlie"
}
],
"Policies": [
{
"PolicyName": "create-update-delete-set-managed-policies",
"CreateDate": "2015-02-06T19:58:34Z",
"AttachmentCount": 1,
"IsAttachable": true,
"PolicyId": "ANPA1234567890EXAMPLE",
"DefaultVersionId": "v1",
"PolicyVersionList": [
{
"CreateDate": "2015-02-06T19:58:34Z",
"VersionId": "v1",
"Document": {
"Version":"2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:CreatePolicy",
"iam:CreatePolicyVersion",
"iam:DeletePolicy",
"iam:DeletePolicyVersion",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:ListPolicies",
"iam:ListPolicyVersions",
"iam:SetDefaultPolicyVersion"
],
"Resource": "*"
}
},
"IsDefaultVersion": true
}
],
"Path": "/",
"Arn": "arn:aws:iam::123456789012:policy/create-update-delete-set-managed-policies",
"UpdateDate": "2015-02-06T19:58:34Z"
},
{
"PolicyName": "S3-read-only-specific-bucket",
"CreateDate": "2015-01-21T21:39:41Z",
"AttachmentCount": 1,
"IsAttachable": true,
"PolicyId": "ANPA1234567890EXAMPLE",
"DefaultVersionId": "v1",
"PolicyVersionList": [
{
"CreateDate": "2015-01-21T21:39:41Z",
"VersionId": "v1",
"Document": {
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": [
"arn:aws:s3:::amzn-s3-demo-bucket",
"arn:aws:s3:::amzn-s3-demo-bucket/*"
]
}
]
},
"IsDefaultVersion": true
}
],
"Path": "/",
"Arn": "arn:aws:iam::123456789012:policy/S3-read-only-specific-bucket",
"UpdateDate": "2015-01-21T23:39:41Z"
},
{
"PolicyName": "AmazonEC2FullAccess",
"CreateDate": "2015-02-06T18:40:15Z",
"AttachmentCount": 1,
"IsAttachable": true,
"PolicyId": "ANPA1234567890EXAMPLE",
"DefaultVersionId": "v1",
"PolicyVersionList": [
{
"CreateDate": "2014-10-30T20:59:46Z",
"VersionId": "v1",
"Document": {
"Version":"2012-10-17",
"Statement": [
{
"Action": "ec2:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "elasticloadbalancing:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "cloudwatch:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "autoscaling:*",
"Resource": "*"
}
]
},
"IsDefaultVersion": true
}
],
"Path": "/",
"Arn": "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
"UpdateDate": "2015-02-06T18:40:15Z"
}
],
"Marker": "EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE",
"IsTruncated": true
}
출력:
PowerShell Tools (V4)
예시 1: AWS 계정의 자격 증명에 대한 인증 세부 정보를 가져오고, 사용자·그룹·역할을 포함한 반환 객체의 요소 목록을 표시해요. 예를 들어 UserDetailList 속성은 사용자에 대한 세부 정보를 보여줘요. RoleDetailList와 GroupDetailList 속성에서도 비슷한 정보를 확인할 수 있어요.
$Details=Get-IAMAccountAuthorizationDetail
$Details
출력:
GroupDetailList : {Administrators, Developers, Testers, Backup}
IsTruncated : False
Marker :
RoleDetailList : {TestRole1, AdminRole, TesterRole, clirole...}
UserDetailList : {Administrator, Bob, BackupToS3, }
$Details.UserDetailList
출력:
Arn : arn:aws:iam::123456789012:user/Administrator
CreateDate : 10/16/2014 9:03:09 AM
GroupList : {Administrators}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE1
UserName : Administrator
UserPolicyList : {}
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 4/6/2015 12:54:42 PM
GroupList : {Developers}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE2
UserName : bab
UserPolicyList : {}
Arn : arn:aws:iam::123456789012:user/BackupToS3
CreateDate : 1/27/2015 10:15:08 AM
GroupList : {Backup}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE3
UserName : BackupToS3
UserPolicyList : {BackupServicePermissionsToS3Buckets}
PowerShell Tools (V5)
예시 1: AWS 계정의 자격 증명에 대한 인증 세부 정보를 가져오고, 사용자·그룹·역할을 포함한 반환 객체의 요소 목록을 표시해요. 예를 들어 UserDetailList 속성은 사용자에 대한 세부 정보를 보여줘요. RoleDetailList와 GroupDetailList 속성에서도 비슷한 정보를 확인할 수 있어요.
$Details=Get-IAMAccountAuthorizationDetail
$Details
출력:
GroupDetailList : {Administrators, Developers, Testers, Backup}
IsTruncated : False
Marker :
RoleDetailList : {TestRole1, AdminRole, TesterRole, clirole...}
UserDetailList : {Administrator, Bob, BackupToS3, }
$Details.UserDetailList
출력:
Arn : arn:aws:iam::123456789012:user/Administrator
CreateDate : 10/16/2014 9:03:09 AM
GroupList : {Administrators}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE1
UserName : Administrator
UserPolicyList : {}
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 4/6/2015 12:54:42 PM
GroupList : {Developers}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE2
UserName : bab
UserPolicyList : {}
Arn : arn:aws:iam::123456789012:user/BackupToS3
CreateDate : 1/27/2015 10:15:08 AM
GroupList : {Backup}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE3
UserName : BackupToS3
UserPolicyList : {BackupServicePermissionsToS3Buckets}
Python(Boto3)
def get_authorization_details(response_filter):
"""
Gets an authorization detail report for the current account.
:param response_filter: A list of resource types to include in the report, such
as users or roles. When not specified, all resources
are included.
:return: The authorization detail report.
"""
try:
account_details = iam.meta.client.get_account_authorization_details(
Filter=response_filter
)
logger.debug(account_details)
except ClientError:
logger.exception("Couldn't get details for your account.")
raise
else:
return account_details
GitHub에 더 많은 내용이 있어요. AWS Code Examples Repository에서 전체 예시를 찾아 실행 방법을 배울 수 있어요.
SAP ABAP
TRY.
oo_result = lo_iam->getaccountauthdetails( ).
MESSAGE 'Retrieved account authorization details.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when getting account authorization details.' TYPE 'E'.
ENDTRY.
GitHub에 더 많은 내용이 있어요. AWS Code Examples Repository에서 전체 예시를 찾아 실행 방법을 배울 수 있어요.