通过 boto3 从所有区域获取未使用的安全列表

Question

我正在尝试从所有地区获取未使用的 SG，但它不起作用。

我试过下面的代码

#!/usr/bin/env python
import boto3

ec2 = boto3.resource('ec2')
regions = ec2.describe_regions().get('Regions',[])
for region in regions:
  reg=region['RegionName']

sgs = list(ec2.security_groups.all())
insts = list(ec2.instances.all())

all_sgs = set([sg.group_name for sg in sgs])
all_inst_sgs = set([sg['GroupName'] for inst in insts for sg in inst.security_groups])
unused_sgs = all_sgs - all_inst_sgs

print 'Total SGs:', len(all_sgs)
print 'SGS attached to instances:', len(all_inst_sgs)
print 'Orphaned SGs:', len(unused_sgs)
print 'Unattached SG names:', unused_sgs

Answer 1

describe_regions 是 ec2 客户端的功能，而不是 ec2 资源。试试这个：

#!/usr/bin/env python
import boto3

ec2 = boto3.client('ec2')
regions = ec2.describe_regions().get('Regions',[])
for region in regions:
  reg=region['RegionName']

但是，您并没有以任何方式使用区域名称。以下代码遍历区域，在每个区域中设置新的 ec2 资源，并重复您的扫描。

#!/usr/bin/env python
import boto3


ec2Client = boto3.client('ec2')
regions = ec2Client.describe_regions().get('Regions',[])
for region in regions:
    reg=region['RegionName']
    print ('Checking region {}'.format(reg))

    ec2 = boto3.resource('ec2', region_name=reg)

    sgs = list(ec2.security_groups.all())
    insts = list(ec2.instances.all())

    all_sgs = set([sg.group_name for sg in sgs])
    all_inst_sgs = set([sg['GroupName'] for inst in insts for sg in inst.security_groups])
    unused_sgs = all_sgs - all_inst_sgs

    print ('    Total SGs:', len(all_sgs))
    print ('    SGS attached to instances:', len(all_inst_sgs))
    print ('    Orphaned SGs:', len(unused_sgs))
    print ('    Unattached SG names:', unused_sgs)

在测试时我发现我有很多未使用的 SG，谢谢。