Python 查询的过滤结果

Question

I'm really noob on Python and i'm currently trying to get and filter the result of a get-iam-policy query on GCP by using this:

from pprint import pprint

from googleapiclient import discovery
from oauth2client.client import GoogleCredentials

credentials = GoogleCredentials.get_application_default()

service = discovery.build('cloudresourcemanager', 'v1', credentials=credentials)

# REQUIRED: The resource for which the policy is being requested.
# See the operation documentation for the appropriate value for this field.
resource = 'my-resource'  # TODO: Update placeholder value.

get_iam_policy_request_body = {
    # TODO: Add desired entries to the request body.
}

request = service.projects().getIamPolicy(resource=resource, body=get_iam_policy_request_body)
response = request.execute()
pprint(response)

It's working fine and i' getting this kind of result:

"version": 1,
  "etag": "VfRwfrGwlFjdc=",
  "bindings": [
    {
      "role": "roles/cloudasset.serviceAgent",
      "members": [
        "serviceAccount:service-999999999999@gcp-sa-cloudasset.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/cloudbuild.builds.builder",
      "members": [
        "serviceAccount:999999999999@cloudbuild.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/cloudbuild.serviceAgent",
      "members": [
        "serviceAccount:service-999999999999@gcp-sa-cloudbuild.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/cloudfunctions.serviceAgent",
      "members": [
        "serviceAccount:service-999999999999@gcf-admin-robot.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/cloudsql.client",
      "members": [
        "serviceAccount:myproject-backup@myproject.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/compute.serviceAgent",
      "members": [
        "serviceAccount:service-999999999999@compute-system.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/container.serviceAgent",
      "members": [
        "serviceAccount:service-999999999999@container-engine-robot.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/containeranalysis.ServiceAgent",
      "members": [
        "serviceAccount:service-999999999999@container-analysis.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/containerscanning.ServiceAgent",
      "members": [
        "serviceAccount:service-999999999999@gcp-sa-containerscanning.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/containerthreatdetection.serviceAgent",
      "members": [
        "serviceAccount:service-999999999999@gcp-sa-ktd-control.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/editor",
      "members": [
        "serviceAccount:999999999999-compute@developer.gserviceaccount.com",
        "serviceAccount:999999999999@cloudservices.gserviceaccount.com",
        "serviceAccount:myproject@appspot.gserviceaccount.com",
        "serviceAccount:service-999999999999@containerregistry.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/owner",
      "members": [
        "serviceAccount:terraform@myproject.iam.gserviceaccount.com",
        "user:myuser@acme.com"
      ]
    },
    {
      "role": "roles/servicenetworking.serviceAgent",
      "members": [
        "serviceAccount:service-999999999999@service-networking.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/websecurityscanner.serviceAgent",
      "members": [
        "serviceAccount:service-999999999999@gcp-sa-websecurityscanner.iam.gserviceaccount.com"
      ]
    }
  ]
}

But I don't know how to to filtering for getting only the members of the "roles/owner" group. In my case:

{
    "role": "roles/owner",
    "members": [
        "serviceAccount:terraform@myproject.iam.gserviceaccount.com",
        "user:myuser@acme.com"
      ]
    }

and put them into a variable for a later print or reuse

is somebody got an idea about how to do that?

Have a nice day.

Answer 1

If you search IAM policy, I recommend you to use Asset Inventory Search IAM policies . You can use it in command line like this:

gcloud asset search-all-iam-policies --query="policy: roles/owner"

And in your python code like this

from google.cloud import asset_v1

scope = 'projects/gbl-imt-homerider-basguillaueb'
query = 'policy: roles/owner'

client = asset_v1.AssetServiceClient()
response = client.search_all_iam_policies(scope,query=query)
for page in response.pages:
    for policy in page:
        print(policy)
    break

Answer 2

Please add below lines to your existing code:

roleList = response['bindings']

for role in roleList:
    for k, v in role.items():
        if v == "roles/owner":
            print(role)

Answer 3

response is a dict which contains a key called 'bindings' , which is a list of dicts. Dicts can be accessed with [] and lists can be filtered with filter from the python core library.

Putting that together, you could do:

members = list(filter(lambda x: x['role'] == 'roles/owner', response['bindings']))[0]['members']