¿Cómo puedo exportar una lista de identidades de IAM Identity Center y sus asignaciones?

Descripción corta

Para generar informes de los conjuntos de permisos de IAM Identity Center, utiliza scripts de Python. Puedes crear un informe JSON de conjuntos de permisos con sus entidades principales asignadas o un archivo .csv de cuentas con sus asignaciones de conjuntos de permisos.

Importante:

• Las API de IAM Identity Center tienen un límite máximo colectivo de 20 transacciones por segundo (TPS).
  Nota: Si recibes errores RequestLimitExceeded y ThrottlingException, consulta Administración y supervisión de la limitación de la API en las cargas de trabajo.
• Cuantas más cuentas incluyas en el script, más tiempo tardará en generarse el informe.

Resolución

Nota: Si se muestran errores al ejecutar comandos de la Interfaz de la línea de comandos de AWS (AWS CLI), consulta Solución de problemas de AWS CLI. Además, asegúrate de utilizar la versión más reciente de la AWS CLI.

Requisitos previos:

• Instala o actualiza AWS SDK para Python (Boto3). 
• Utiliza uno de los métodos siguientes para configurar la AWS CLI y AWS SDK para Python con las credenciales adecuadas:
  Ejecuta el comando configure de la AWS CLI. Para obtener más información, consulta Configuración mediante los comandos de la AWS CLI.
  Usa credenciales de seguridad temporales.
• Configura un perfil para la AWS CLI con credenciales para una entidad principal de IAM que tenga los siguientes permisos:
  Permite el acceso a la cuenta de administración de Organizations o a la cuenta de administrador delegado de IAM Identity Center.
  Adjunta las políticas administradas de AWS AWSSSOReadOnly y AWSSSODirectoryReadOnly.

Generación de un informe de conjuntos de permisos con las entidades principales asignadas

Sigue estos pasos:

1. Guarda el siguiente script de comandos de Python con una extensión .py, como permission_sets_report.py:

   import boto3, json
   
   idstoreclient = boto3.client('identitystore')
   ssoadminclient = boto3.client('sso-admin')
   orgsclient= boto3.client('organizations')
   
   users={}
   groups={}
   permissionSets={}
   Accounts=[]
   
   Instances= (ssoadminclient.list_instances()).get('Instances')
   InstanceARN=Instances[0].get('InstanceArn')
   IdentityStoreId=Instances[0].get('IdentityStoreId')
   
   #Dictionary mapping User IDs to usernames
   def mapUserIDs():
       ListUsers=idstoreclient.list_users(IdentityStoreId=IdentityStoreId)
       ListOfUsers=ListUsers['Users']
       while 'NextToken' in ListUsers.keys():
           ListUsers=idstoreclient.list_users(IdentityStoreId=IdentityStoreId,NextToken=ListUsers['NextToken'])
           ListOfUsers.extend(ListUsers['Users'])
       for eachUser in ListOfUsers:
           users.update({eachUser.get('UserId'):eachUser.get('UserName')})
   mapUserIDs()
   
   #Dictionary mapping Group IDs to display names
   def mapGroupIDs():
       ListGroups=idstoreclient.list_groups(IdentityStoreId=IdentityStoreId)
       ListOfGroups=ListGroups['Groups']
       while 'NextToken' in ListGroups.keys():
           ListGroups=idstoreclient.list_groups(IdentityStoreId=IdentityStoreId,NextToken=ListGroups['NextToken'])
           ListOfGroups.extend(ListGroups['Groups'])
       for eachGroup in ListOfGroups:
           groups.update({eachGroup.get('GroupId'):eachGroup.get('DisplayName')})
   mapGroupIDs()
   
   #Dictionary mapping permission set ARNs to permission set names
   def mapPermissionSetIDs():
       ListPermissionSets=ssoadminclient.list_permission_sets(InstanceArn=InstanceARN)
       ListOfPermissionSets=ListPermissionSets['PermissionSets']
       while 'NextToken' in ListPermissionSets.keys():
           ListPermissionSets=ssoadminclient.list_permission_sets(InstanceArn=InstanceARN,NextToken=ListPermissionSets['NextToken'])
           ListOfPermissionSets.extend(ListPermissionSets['PermissionSets'])
       for eachPermissionSet in ListOfPermissionSets:
           permissionSetDescription=ssoadminclient.describe_permission_set(InstanceArn=InstanceARN,PermissionSetArn=eachPermissionSet)
           permissionSetDetails=permissionSetDescription.get('PermissionSet')
           permissionSets.update({permissionSetDetails.get('PermissionSetArn'):permissionSetDetails.get('Name')})
   mapPermissionSetIDs()
   
   #Listing Permissionsets provisioned to an account
   def GetPermissionSetsProvisionedToAccount(AccountID):
       ListOfPermissionSetsProvisionedToAccount=[]
       PermissionSetsProvisionedToAccount=ssoadminclient.list_permission_sets_provisioned_to_account(InstanceArn=InstanceARN,AccountId=AccountID)
       try:
           ListOfPermissionSetsProvisionedToAccount = PermissionSetsProvisionedToAccount['PermissionSets']
           while 'NextToken' in PermissionSetsProvisionedToAccount.keys():
               PermissionSetsProvisionedToAccount=ssoadminclient.list_permission_sets_provisioned_to_account(InstanceArn=InstanceARN,AccountId=AccountID,NextToken=PermissionSetsProvisionedToAccount['NextToken'])
               ListOfPermissionSetsProvisionedToAccount.extend(PermissionSetsProvisionedToAccount['PermissionSets'])
           return(ListOfPermissionSetsProvisionedToAccount)
       except:
           return(ListOfPermissionSetsProvisionedToAccount)
   
   
   #To retrieve the assignment of each permissionset/user/group/account assignment
   def ListAccountAssignments(AccountID):
       PermissionSetsList=GetPermissionSetsProvisionedToAccount(AccountID)
       Assignments=[]
       for permissionSet in PermissionSetsList:
           AccountAssignments=ssoadminclient.list_account_assignments(InstanceArn=InstanceARN,AccountId=AccountID,PermissionSetArn=permissionSet)
           Assignments.extend(AccountAssignments['AccountAssignments'])
           while 'NextToken' in AccountAssignments.keys():
               AccountAssignments=ssoadminclient.list_aaccount_assignments(InstanceArn=InstanceARN,AccountId=AccountID,PermissionSetArn=permissionSet,NextToken=AccountAssignments['NextToken'])
               Assignments.extend(AccountAssignments['AccountAssignments'])
       return(Assignments)
   
   #To list all the accounts in the organization
   def ListAccountsInOrganization():
       AccountsList=orgsclient.list_accounts()
       ListOfAccounts=AccountsList['Accounts']
       while 'NextToken' in AccountsList.keys():
           AccountsList=orgsclient.list_accounts(NextToken=AccountsList['NextToken'])
           ListOfAccounts.extend(AccountsList['Accounts'])
       for eachAccount in ListOfAccounts:
           Accounts.append(str(eachAccount.get('Id')))
       return(Accounts)
   
   #To translate set datatype to json
   class SetEncoder(json.JSONEncoder):
       def default(self, obj):
           if isinstance(obj, set):
               return list(obj)
           return json.JSONEncoder.default(self, obj)
   
   def GetListOfAssignmentsForPermissionSets():
       ListOfAccountIDs=ListAccountsInOrganization()
       entries=[]
       PermissionSetListForAssignments={}
       for eachAccountID in ListOfAccountIDs:
           GetAccountAssignments=ListAccountAssignments(eachAccountID)
           for eachAssignment in GetAccountAssignments:
               if(permissionSets.get(eachAssignment.get('PermissionSetArn'))) not in PermissionSetListForAssignments.keys():
                   SetOfUsersandGroups={'Users':set(),'Groups':set()}
                   PermissionSetListForAssignments[permissionSets.get(eachAssignment.get('PermissionSetArn'))]=SetOfUsersandGroups
               SetOfUsersandGroups=PermissionSetListForAssignments.get(permissionSets.get(eachAssignment.get('PermissionSetArn')))
               if(eachAssignment.get('PrincipalType')=='GROUP'):
                   setOfGroups=SetOfUsersandGroups.get('Groups')
                   setOfGroups.add(groups.get(eachAssignment.get('PrincipalId')))
                   SetOfUsersandGroups.update({'Groups':setOfGroups})
                   PermissionSetListForAssignments.update({permissionSets.get(eachAssignment.get('PermissionSetArn')):SetOfUsersandGroups})
               else:
                   setOfUsers=SetOfUsersandGroups.get('Users')
                   setOfUsers.add(users.get(eachAssignment.get('PrincipalId')))
                   SetOfUsersandGroups.update({'Users':setOfUsers})
                   PermissionSetListForAssignments.update({permissionSets.get(eachAssignment.get('PermissionSetArn')):SetOfUsersandGroups})
       with open("AssignmentsForPermissionSets.json", "w") as outfile:
           json.dump(PermissionSetListForAssignments, outfile, cls=SetEncoder)
       print("Done!AssignmentsForPermissionSets.json generated successfully!")
   GetListOfAssignmentsForPermissionSets()

   Nota: Si recibes el error "IndexError: list index out of range", significa que el script se encuentra en una región de AWS que no es la región en la que has configurado IAM Identity Center.

2. Ejecuta el script de Python en una ventana de terminal (macOS) o PowerShell (Windows).

El script crea un archivo JSON denominado AssignmentsForPermissionSets.json que contiene los conjuntos de permisos y sus entidades principales asignadas.

Resultado de ejemplo:

{  "AdministratorAccess": {    "Users": [
      "Charlie",
      "Ted"
    ],
    "Groups": [
      "Admins",
      "Developers"
    ]
  },
  "PowerUserAccess": {
    "Users": [
      "Chandler",
      "Joey"
    ],
    "Groups": [
      "Developers",
      "Testers"
    ]
  },
  "SystemAdministrator": {
    "Users": [
      "Sherlock"
    ],
    "Groups": [
      "DevOps"
    ]
  }
}

Nota: Si un conjunto de permisos no aparece en el informe, significa que no has proporcionado un conjunto de permisos para las cuentas.

Generación de un informe con las asignaciones de cuentas del conjunto de permisos

Sigue estos pasos:

1. Guarda la siguiente secuencia de comandos de Python con una extensión .py, como account_assignments_report.py:

   import boto3, csv
   
   idstoreclient = boto3.client('identitystore')
   ssoadminclient = boto3.client('sso-admin')
   orgsclient= boto3.client('organizations')
   
   users={}
   groups={}
   permissionSets={}
   Accounts={}
   
   Instances= (ssoadminclient.list_instances()).get('Instances')
   InstanceARN=Instances[0].get('InstanceArn')
   IdentityStoreId=Instances[0].get('IdentityStoreId')
   
   
   #Dictionary mapping User IDs to usernames
   def mapUserIDs():
       ListUsers=idstoreclient.list_users(IdentityStoreId=IdentityStoreId)
       ListOfUsers=ListUsers['Users']
       while 'NextToken' in ListUsers.keys():
           ListUsers=idstoreclient.list_users(IdentityStoreId=IdentityStoreId,NextToken=ListUsers['NextToken'])
           ListOfUsers.extend(ListUsers['Users'])
       for eachUser in ListOfUsers:
           users.update({eachUser.get('UserId'):eachUser.get('UserName')})
   mapUserIDs()
   
   #Dictionary mapping Group IDs to display names
   def mapGroupIDs():
       ListGroups=idstoreclient.list_groups(IdentityStoreId=IdentityStoreId)
       ListOfGroups=ListGroups['Groups']
       while 'NextToken' in ListGroups.keys():
           ListGroups=idstoreclient.list_groups(IdentityStoreId=IdentityStoreId,NextToken=ListGroups['NextToken'])
           ListOfGroups.extend(ListGroups['Groups'])
       for eachGroup in ListOfGroups:
           groups.update({eachGroup.get('GroupId'):eachGroup.get('DisplayName')})
   mapGroupIDs()
   
   #Dictionary mapping permission set ARNs to permission set names
   def mapPermissionSetIDs():
       ListPermissionSets=ssoadminclient.list_permission_sets(InstanceArn=InstanceARN)
       ListOfPermissionSets=ListPermissionSets['PermissionSets']
       while 'NextToken' in ListPermissionSets.keys():
           ListPermissionSets=ssoadminclient.list_permission_sets(InstanceArn=InstanceARN,NextToken=ListPermissionSets['NextToken'])
           ListOfPermissionSets.extend(ListPermissionSets['PermissionSets'])
       for eachPermissionSet in ListOfPermissionSets:
           permissionSetDescription=ssoadminclient.describe_permission_set(InstanceArn=InstanceARN,PermissionSetArn=eachPermissionSet)
           permissionSetDetails=permissionSetDescription.get('PermissionSet')
           permissionSets.update({permissionSetDetails.get('PermissionSetArn'):permissionSetDetails.get('Name')})
   mapPermissionSetIDs()
   
   #Listing Permissionsets provisioned to an account
   def GetPermissionSetsProvisionedToAccount(AccountID):
       PermissionSetsProvisionedToAccount=ssoadminclient.list_permission_sets_provisioned_to_account(InstanceArn=InstanceARN,AccountId=AccountID)
       ListOfPermissionSetsProvisionedToAccount = PermissionSetsProvisionedToAccount['PermissionSets']
       while 'NextToken' in PermissionSetsProvisionedToAccount.keys():
           PermissionSetsProvisionedToAccount=ssoadminclient.list_permission_sets_provisioned_to_account(InstanceArn=InstanceARN,AccountId=AccountID,NextToken=PermissionSetsProvisionedToAccount['NextToken'])
           ListOfPermissionSetsProvisionedToAccount.extend(PermissionSetsProvisionedToAccount['PermissionSets'])    
       return(ListOfPermissionSetsProvisionedToAccount)
   
   #To retrieve the assignment of each permissionset/user/group/account assignment
   def ListAccountAssignments(AccountID):
       PermissionSetsList=GetPermissionSetsProvisionedToAccount(AccountID)
       Assignments=[]
       for permissionSet in PermissionSetsList:
           AccountAssignments=ssoadminclient.list_account_assignments(InstanceArn=InstanceARN,AccountId=AccountID,PermissionSetArn=permissionSet)
           Assignments.extend(AccountAssignments['AccountAssignments'])
           while 'NextToken' in AccountAssignments.keys():
               AccountAssignments=ssoadminclient.list_aaccount_assignments(InstanceArn=InstanceARN,AccountId=AccountID,PermissionSetArn=permissionSet,NextToken=AccountAssignments['NextToken'])
               Assignments.extend(AccountAssignments['AccountAssignments'])
       return(Assignments)
   
   
   #To list all the accounts in the organization
   def ListAccountsInOrganization():
       AccountsList=orgsclient.list_accounts()
       ListOfAccounts=AccountsList['Accounts']
       while 'NextToken' in AccountsList.keys():
           AccountsList=orgsclient.list_accounts(NextToken=AccountsList['NextToken'])
           ListOfAccounts.extend(AccountsList['Accounts'])
       for eachAccount in ListOfAccounts:
           Accounts.update({eachAccount.get('Id'):eachAccount.get('Name')})
       return(Accounts)
   
   def WriteToExcel():
       Accounts=ListAccountsInOrganization()
       ListOfAccountIDs=list(Accounts.keys())
       entries=[]
       for eachAccountID in ListOfAccountIDs:
           try:
               GetAccountAssignments=ListAccountAssignments(eachAccountID)
               for eachAssignment in GetAccountAssignments:
                   entry=[]
                   entry.append(eachAssignment.get('AccountId'))
                   entry.append(Accounts.get(eachAssignment.get('AccountId')))
                   entry.append(permissionSets.get(eachAssignment.get('PermissionSetArn')))
                   entry.append(eachAssignment.get('PrincipalType'))
                   if(eachAssignment.get('PrincipalType')=='GROUP'):
                       entry.append(groups.get(eachAssignment.get('PrincipalId')))
                   else:
                       entry.append(users.get(eachAssignment.get('PrincipalId')))
                   entries.append(entry)
           except:
               continue
       filename = "IdentityStoreReport.csv"
       headers=['Account ID', 'Account Name', 'Permission Set','Principal Type', 'Principal']
   
       with open(filename, 'w') as report:
           csvwriter = csv.writer(report)
           csvwriter.writerow(headers)
           csvwriter.writerows(entries)
       print("Done! 'IdentityStoreReport.csv' report is generated successfully!")
   WriteToExcel()

2. Ejecuta el script de Python en una ventana de terminal (macOS) o PowerShell (Windows).

El script crea un archivo .csv denominado IdentityStoreReport.csv que contiene las asignaciones de cuentas. El sistema guarda el archivo .csv en el mismo directorio que el informe de conjuntos de permisos.

Resultado de ejemplo de un archivo .csv:

ID de la cuenta	Nombre de la cuenta	Conjunto de permisos	Tipo de entidad principal	Entidad principal
123456789012	Desarrollo	PowerUserAccess	GRUPO	Desarrolladores
123456789012	Desarrollo	PowerUserAccess	USUARIO	Ross
123456789012	Desarrollo	AdministratorAccess	USUARIO	Phoebe
123456789012	Desarrollo	SystemAdministrator	USUARIO	Jake
345678901234	Producción	AdministratorAccess	GRUPO	Administradores
345678901234	Producción	AdministratorAccess	GRUPO	Pruebas
901234567890	Preparación	PowerUserAccess	GRUPO	Pruebas
901234567890	Preparación	AdministratorAccess	GRUPO	Cliente
901234567890	Preparación	PowerUserAccess	USUARIO	Gina
901234567890	Preparación	PowerUserAccess	GRUPO	Administradores

Nota: Si una cuenta no aparece en el informe, significa que no has aprovisionado conjuntos de permisos para la cuenta.