如何列出所有允许IP范围到任何地方的网关？

Question

是否有一个aws-cli来列出与此处描述的安全组类似的API网关中的所有开放端口https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html

aws ec2 describe-security-groups --filters Name=ip-permission.from-port,Values=22 Name=ip-permission.to-port,Values=22 Name=ip-permission.cidr,Values='0.0.0.0/0' --query "SecurityGroups[*].{Name:GroupName}"

接口网关中的策略定义如下：How to allow only an IP/range access to AWS API Gateway resources

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::<account_idA>:user/<user>",
                    "arn:aws:iam::<account_idA>:root"
                ]
            },
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*/*/*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "0.0.0.0/0"
                }
            }
        }
    ]
}

一个解决方案可能是在查询中使用list-policies-for-target，但是如何找到网关等呢？

Answer 1

我想这可能行得通

aws apigateway get-rest-apis --query "items[?policy != null ].[id,name,policy]" --output text | grep "0.0.0.0"

您可以进一步修改grep命令以返回接受或拒绝的值。