如何在GCP asset_v1 Python客户端中筛选用户管理的SA密钥？

问题 #

我尝试用Python检索组织内所有用户管理的ServiceAccount密钥，使用了Google官方文档的Asset API代码片段：

from google.cloud import asset_v1
import google.auth
import json

credentials, project = google.auth.default() 

asset = asset_v1.AssetServiceClient(credentials=credentials)
keys = asset.search_all_resources(
    scope="organizations/<your_organization_number>", 
    query="(createTime > 2024-03-20)",
    asset_types = ["iam.googleapis.com/ServiceAccountKey"], 
    )
for key in keys:
    print(key.display_name) 

这段代码能正常运行，但返回结果包含了Google提供的密钥，而且API响应里没有区分用户管理和Google提供的密钥。我通过IAM API的代码验证了密钥属性：

import os
import google.auth
import googleapiclient.discovery

credentials, project = google.auth.default() 
service = googleapiclient.discovery.build("iam", "v1", credentials=credentials)

keys = (
    service.projects()
    .serviceAccounts()
    .keys()
    .list(name="projects/-/serviceAccounts/<YOUR_SA_WITH_SA_KEYS>")
    .execute()
)
for key in keys["keys"]:
    print(key)

返回示例：

{'name': 'projects/-/serviceAccounts/your_sa.iam.gserviceaccount.com/keys/key0', 'validAfterTime': 'xxxx-xx-xxTxx:xx:xxZ', 'validBeforeTime': 'xxxx-xx-xxTxx:xx:xxZ', 'keyAlgorithm': 'KEY_ALG_RSA_2048', 'keyOrigin': 'GOOGLE_PROVIDED', 'keyType': 'SYSTEM_MANAGED'}
{'name': 'projects/-/serviceAccounts/your_sa.iam.gserviceaccount.com/keys/key1', 'validAfterTime': 'xxxx-xx-xxTxx:xx:xxZ', 'validBeforeTime': "xxxx-xx-xxTxx:xx:xxZ", 'keyAlgorithm': 'KEY_ALG_RSA_2048', 'keyOrigin': 'GOOGLE_PROVIDED', 'keyType': 'SYSTEM_MANAGED'}
{'name': 'projects/-/serviceAccounts/your_sa.iam.gserviceaccount.com/keys/key2', 'validAfterTime': 'xxxx-xx-xxTxx:xx:xxZ', 'validBeforeTime': 'xxxx-xx-xxTxx:xx:xxZ', 'keyOrigin': 'USER_PROVIDED', 'keyType': 'USER_MANAGED'}

请问能不能通过search_all_resources的query参数排除keyOrigin为GOOGLE_PROVIDED的密钥，避免多次请求？

解决方案 #

可以直接通过search_all_resources的query参数过滤掉Google提供的密钥，无需额外调用IAM API。

Google Asset Inventory的查询语法支持对iam.googleapis.com/ServiceAccountKey资源的keyOrigin字段进行过滤。你只需要在原有的query条件中添加keyOrigin = 'USER_PROVIDED'（或者keyOrigin != 'GOOGLE_PROVIDED'）的逻辑即可。

修改后的代码如下：

from google.cloud import asset_v1
import google.auth
import json

credentials, project = google.auth.default() 

asset = asset_v1.AssetServiceClient(credentials=credentials)
keys = asset.search_all_resources(
    scope="organizations/<your_organization_number>", 
    query="(createTime > 2024-03-20) AND keyOrigin = 'USER_PROVIDED'",
    asset_types = ["iam.googleapis.com/ServiceAccountKey"], 
    )
for key in keys:
    print(key.display_name) 

需要注意的是，search_all_resources返回的Resource对象默认不会展示所有属性（比如keyOrigin），但Asset Inventory已经索引了这些字段，因此可以直接用于查询过滤。这样就能一次性获取所有用户管理的ServiceAccount密钥，避免后续的二次请求。

内容的提问来源于stack exchange，提问作者Cole Gulledge