amazon-web-services - 给定角色 ARN，如何找出创建该角色的堆栈和区域？

Question

任何人都可以提供 CLI 命令来获取创建特定 IAM 角色的堆栈名称和区域吗？

Answer 1

您必须编写一个小的循环脚本来遍历所有区域和所有堆栈(假设为“CREATE_COMPLETE”状态)并使用describe-stack-resources CLI 命令。

https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-resources.html

这是一个小例子:

#!/bin/bash

for region in us-east-2 us-east-1 us-west-1 us-west-2 ap-east-1 ap-south-1 ap-northeast-3 ap-northeast-2 ap-southeast-1 ap-southeast-2 ap-northeast-1 ca-central-1 cn-north-1 cn-northwest-1 eu-central-1 eu-west-1 eu-west-2 eu-west-3 eu-north-1 me-south-1 sa-east-1
do
        echo "Processing region $region ..."
        for stack in $(aws cloudformation list-stacks --stack-status-filter CREATE_COMPLETE --output json --region $region | jq '.StackSummaries[] | .StackId' | sed -e 's/^"//' -e 's/"$//')
        do
                echo "Processing stack $stack ..."
                aws cloudformation describe-stack-resources --stack-name $stack --output json --region $region | jq '.StackResources[] | select(.ResourceType=="AWS::IAM::Role") | select(.PhysicalResourceId=="PUT_YOUR_ROLE_NAME_HERE")'
        done
done

不要忘记，如果您有角色 ARN，您可以轻松获取您的帐号和角色名称。格式为

arn:aws:iam::account-id:role/role-name

我希望这会有所帮助，对于单行线感到抱歉，它的可读性较差。