如何通过AWS ListGroupResources接口返回带标签的资源组资源？

核心思路 #

ListGroupResources接口仅返回资源的标识符（ARN、ID等）和类型，无法直接获取标签。要拿到资源标签，需要结合Resource Groups Tagging API的GetResources接口，分两步实现：

1. 调用ListGroupResources获取资源组内所有资源的ARN和类型
2. 批量将ARN传入GetResources接口，获取对应资源的完整标签

具体步骤 #

1. 获取资源组内的资源列表

调用ListGroupResources接口（注意处理分页），收集所有资源的ARN：

import boto3

rg_client = boto3.client('resource-groups')

def fetch_group_resources(group_name):
    resources = []
    next_token = None
    while True:
        params = {'GroupName': group_name}
        if next_token:
            params['NextToken'] = next_token
        resp = rg_client.list_group_resources(**params)
        resources.extend(resp['ResourceIdentifiers'])
        next_token = resp.get('NextToken')
        if not next_token:
            break
    return resources

2. 批量获取资源标签

使用resourcegroupstaggingapi客户端的GetResources接口，传入收集到的ARN列表（注意每次最多传入100个ARN，超过需分批）：

tag_client = boto3.client('resourcegroupstaggingapi')

def fetch_resource_tags(resource_arns):
    tag_map = {}
    # 分批处理，每次最多100个ARN
    for i in range(0, len(resource_arns), 100):
        batch_arns = resource_arns[i:i+100]
        next_token = None
        while True:
            params = {'ResourceArns': batch_arns}
            if next_token:
                params['NextToken'] = next_token
            resp = tag_client.get_resources(**params)
            for item in resp['ResourceTagMappingList']:
                tag_map[item['ResourceARN']] = item['Tags']
            next_token = resp.get('NextToken')
            if not next_token:
                break
    return tag_map

3. 整合结果

将资源信息与标签匹配输出：

# 替换为你的资源组名称
GROUP_NAME = "your-resource-group"

resources = fetch_group_resources(GROUP_NAME)
resource_arns = [res['ResourceArn'] for res in resources]
tag_map = fetch_resource_tags(resource_arns)

# 打印资源及其标签
for res in resources:
    arn = res['ResourceArn']
    print(f"资源ARN: {arn}")
    print(f"资源类型: {res['ResourceType']}")
    print(f"标签: {tag_map.get(arn, '无标签')}\n")

关键说明 #

• AWS控制台之所以能显示标签，是因为后台自动组合了ListGroupResources和GetResources接口的结果
• IAM权限要求：需授予resource-groups:ListGroupResources和tag:GetResources权限
• 特殊资源处理：少数不支持Tagging API的资源（如部分旧款资源），需单独调用对应服务的标签接口（例如EC2用DescribeTags，S3用GetBucketTagging）

内容的提问来源于stack exchange，提问作者DaviACT