使用Boto3创建AWS SSO账号分配时先显示进行中后失败的问题

环境信息 #

• env: python3 venv and using boto3 apis

问题描述 #

已在身份存储中创建组和权限集，尝试通过API将组绑定到权限集（已获取两者的ID和ARN），但调用create_account_assignment后返回状态为IN_PROGRESS，后续通过list_account_assignment_creation_status查询显示失败，且未获取到失败原因。需求是实现操作能明确返回成功/失败状态，并获取失败原因。

相关代码 #

创建权限集代码 #

def create_permission_set(self, instance_arn, name):
        client = boto3.client('sso-admin', aws_access_key_id=self.access_key,aws_secret_access_key=self.secret_key, region_name =self.region_name)
        response = client.create_permission_set(
            InstanceArn=instance_arn,
            Name=name
        )

绑定组与权限集代码 #

def bind_group_permission_set(self,permission_set_arn,group_id,instance_id,instance_arn):
        client = boto3.client('sso-admin', aws_access_key_id=self.access_key, 
                                aws_secret_access_key=self.secret_key, 
                                region_name =self.region_name)
        
        response = client.create_account_assignment(
            InstanceArn=instance_arn,
            PermissionSetArn=permission_set_arn,
            PrincipalId=group_id,
            PrincipalType='GROUP',
            TargetId='8xxxxxxxxxxxx3',
            TargetType='AWS_ACCOUNT'
        )
        return response

调用返回示例 #

{'AccountAssignmentCreationStatus': 
{'PermissionSetArn': '', 'PrincipalId': '', 'PrincipalType': 'GROUP', 'RequestId': '', 'Status': 'IN_PROGRESS', 'TargetId': '', 'TargetType': 'AWS_ACCOUNT'}, 'ResponseMetadata': {'RequestId': '', 'HTTPStatusCode': 200, 'HTTPHeaders': {'date': 'Thu, 11 Jan 2024 06:05:43 GMT', 'content-type': 'application/x-amz-json-1.1', 'content-length': '334', 'connection': 'keep-alive', 'x-amzn-requestid': ''}, 'RetryAttempts': 0}}

解决方案与说明 #

1. 关于IN_PROGRESS状态的说明 #

AWS SSO的create_account_assignment接口本身是异步操作，设计逻辑就是先返回IN_PROGRESS状态，后台执行实际的分配任务，无法直接同步返回最终结果。必须通过后续查询获取最终状态。

2. 获取失败原因的正确方式 #

list_account_assignment_creation_status通常不会返回详细失败信息，应改用describe_account_assignment_creation_status接口，传入create_account_assignment返回的RequestId，该接口会返回FailureReason字段，包含具体失败原因。

以下是添加轮询逻辑的示例代码：

import time

def wait_for_assignment_status(self, instance_arn, request_id):
    client = boto3.client('sso-admin', aws_access_key_id=self.access_key, 
                          aws_secret_access_key=self.secret_key, 
                          region_name=self.region_name)
    
    while True:
        response = client.describe_account_assignment_creation_status(
            InstanceArn=instance_arn,
            RequestId=request_id
        )
        status = response['AccountAssignmentCreationStatus']['Status']
        if status in ['SUCCEEDED', 'FAILED']:
            failure_reason = response['AccountAssignmentCreationStatus'].get('FailureReason', '无详细失败原因')
            return status, failure_reason
        # 间隔3秒重试，可根据实际情况调整
        time.sleep(3)

# 改造后的绑定方法
def bind_group_permission_set(self,permission_set_arn,group_id,instance_id,instance_arn):
        client = boto3.client('sso-admin', aws_access_key_id=self.access_key, 
                                aws_secret_access_key=self.secret_key, 
                                region_name =self.region_name)
        
        response = client.create_account_assignment(
            InstanceArn=instance_arn,
            PermissionSetArn=permission_set_arn,
            PrincipalId=group_id,
            PrincipalType='GROUP',
            TargetId='8xxxxxxxxxxxx3',
            TargetType='AWS_ACCOUNT'
        )
        request_id = response['AccountAssignmentCreationStatus']['RequestId']
        # 等待获取最终状态
        final_status, failure_reason = self.wait_for_assignment_status(instance_arn, request_id)
        return {
            'final_status': final_status,
            'failure_reason': failure_reason,
            'original_response': response
        }

3. 常见失败原因排查 #

如果最终状态为失败，可优先排查以下几点：

• 权限集ARN、组ID是否正确，确认资源属于当前SSO实例
• 目标AWS账户是否已加入SSO实例，账户ID是否输入错误
• 调用API的IAM身份是否拥有sso-admin:CreateAccountAssignment等相关权限
• 权限集是否完成预配置（若关联了托管/自定义策略，需确保配置生效）

内容的提问来源于stack exchange，提问作者Sandeepa Kariyawasam