关于如何使用 python 列出 gcp 服务帐户密钥的任何想法

Question

我需要组织内所有 GCP 项目中的所有服务帐户密钥的列表。我正在寻找的是处于活动状态的用户管理服务帐户密钥的列表...下面是我正在使用的代码

不确定缺少什么，我没有看到用户管理服务帐户密钥，我只看到系统管理。如何获取用户管理服务帐户密钥的列表？

Answer 1

您正在调用 projects.serviceAccounts.keys .list 方法，带有（可选？）KeyType
SYSTEM_MANAGED 但您想要 USER_MANAGED

我鼓励您放弃所有 subprocess 内容。它完全是多余的，使您的代码变得不必要的复杂和有问题。

例子

import google.auth

from googleapiclient import discovery


credentials, project = google.auth.default()

crm = discovery.build(
    "cloudresourcemanager",
    "v1",
    credentials=credentials
)
iam = discovery.build(
    "iam",
    "v1",
    credentials=credentials
)

projects_list_rqst = crm.projects().list()

while projects_list_rqst is not None:
    projects_list_resp = projects_list_rqst.execute()
    projects = projects_list_resp.get("projects",[])

    for project in projects:
        project_id = project["projectId"]
        print(f"Project: {project_id}")
        name="projects/{project_id}".format(project_id=project_id) 
        sa_list_rqst = iam.projects().serviceAccounts().list(
            name=name
        )

        while sa_list_rqst is not None:
            sa_list_resp = sa_list_rqst.execute()
            accounts = sa_list_resp.get("accounts",[])

            for account in accounts:
                name=account["name"]
                print(f"\tAccount: {name}")
                keys_list_rqst = iam.projects().serviceAccounts().keys().list(
                    name=name,
                    keyTypes="USER_MANAGED"
                )
                keys_list_resp = keys_list_rqst.execute()
                keys = keys_list_resp.get("keys",[])

                for key in keys:
                    name=key["name"]
                    print(f"\t\tKey: {name}")
            
            sa_list_rqst = iam.projects().serviceAccounts().list_next(
                previous_request=sa_list_rqst,
                previous_response=sa_list_resp
            )

    projects_list_rqst = crm.projects().list_next(
        previous_request=projects_list_rqst,
        previous_response=projects_list_resp)