有时(不经常)下面的json有额外的字段
之间
EventName
和
EventSources
打电话
Username
.
例如:
"EventName": "AssumeRole",
"EventSource": "sts.amazonaws.com",
"Username": "someuser"
有时它不会(如下所示)
我想创建if-else,所以if
"Username": "someuser"
有没有,打印一个输出,如果没有,打印另一个。
with open('1.json') as file:
data = json.load(file)
with open('cloudtrail.csv', 'wt') as file:
#file.write('ResourceType,ResourceName,EventName,UserName\n')
for element in data['Events']:
if element['Username']:
for resource in element['Resources']:
print(resource['ResourceType'] + ',' + resource['ResourceName'] + ',' + element['EventName'] + ',' + element['Username'])
else:
print(resource['ResourceType'] + ',' + resource['ResourceName'] + ',' + element['EventName'])
但面对这个(因为
element['Username']
不存在):
File "./cloud.py", line 24, in <module>
if element['Username']:
KeyError: 'Username'
显然,我的假设逻辑出了问题
{
"Events": [
{
"EventId": "62c8bac9-c486-4e1e-9603-58d8ba4a20f4",
"EventTime": 1529020719.0,
"CloudTrailEvent": "{\"eventVersion\":\"1.05\",\"userIdentity\":{\"type\":\"AWSService\",\"invokedBy\":\"vpc-flow-logs.amazonaws.com\"},\"eventTime\":\"2018-06-14T23:58:39Z\",\"eventSource\":\"sts.amazonaws.com\",\"eventName\":\"AssumeRole\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"vpc-flow-logs.amazonaws.com\",\"userAgent\":\"vpc-flow-logs.amazonaws.com\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::279052847476:role/flowlogsRole\",\"roleSessionName\":\"vpc-flow-logging+279052847476\",\"externalId\":\"vpc-flow-logging+279052847476\",\"durationSeconds\":3600},\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIAIOD3JIGRTBSRNP7A\",\"expiration\":\"Jun 15, 2018 12:58:39 AM\",\"sessionToken\":\"FQoDYXdzEIH//////////wEaDHKlf7uMLL744fS/RCLgAcSDdZYK7gVctXe76EuIIC+De68ZK21fz30fWwGuxRFmiMREIjLMZmxD/vMsNKLVoutHOLJzBs1VIi62uf8reZThmuU2eFQI1DVAM9Pmfr7iWySEX0ZzmaD9kuNPTM0T1OqudTqopDtgU0aRL0t6jlhASOK6UvH/2eNllSaFxU0l51GaUDfrKqRR9ejqAs0PyQx/0ymq71yqCRT2dVuyACVF9nbs0agt/y4Ke3T5MpKrjQUhPQF4c77sxGN3/OuMkx7G91pBYifjuOMx1SWf7PuqoU0hIEPmzmfmJdVMRbKpKK+CjNkF\"},\"assumedRoleUser\":{\"assumedRoleId\":\"AROAJMTKGPJI67TAWGXVG:vpc-flow-logging+279052847476\",\"arn\":\"arn:aws:sts::279052847476:assumed-role/flowlogsRole/vpc-flow-logging+279052847476\"}},\"requestID\":\"dc1636da-702e-11e8-a991-13cc235e6bd3\",\"eventID\":\"62c8bac9-c486-4e1e-9603-58d8ba4a20f4\",\"resources\":[{\"ARN\":\"arn:aws:iam::279052847476:role/flowlogsRole\",\"accountId\":\"279052847476\",\"type\":\"AWS::IAM::Role\"}],\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"279052847476\",\"sharedEventID\":\"c06bf41d-9758-4b33-abdb-86774f67c5c9\"}",
"EventName": "AssumeRole",
"EventSource": "sts.amazonaws.com",
"Resources": [
{
"ResourceType": "AWS::IAM::AccessKey",
"ResourceName": "ASIAIOD3JIGRTBSRNP7A"
},
{
"ResourceType": "AWS::STS::AssumedRole",
"ResourceName": "vpc-flow-logging+279052847476"
},
{
"ResourceType": "AWS::STS::AssumedRole",
"ResourceName": "arn:aws:sts::279052847476:assumed-role/flowlogsRole/vpc-flow-logging+279052847476"
},
{
"ResourceType": "AWS::STS::AssumedRole",
"ResourceName": "AROAJMTKGPJI67TAWGXVG:vpc-flow-logging+279052847476"
},
}]