求助：使用AWS SDK和CLI获取IdentityStore用户时缺失status字段

问题原因 #

AWS IdentityStore的list-users和get-user接口本身不返回用户状态（Status）字段，你在控制台看到的用户状态属于IAM Identity Center（原SSO）的状态数据，必须通过SSO Admin API才能获取。

解决方案 #

1. 使用AWS CLI获取带状态的用户数据 #

先获取你的SSO实例ARN：

aws sso-admin list-instances

再用该实例ARN调用list-users，返回结果会包含Status字段（取值为ENABLED或DISABLED）：

aws sso-admin list-users --instance-arn "arn:aws:sso:::instance/ssoins-XXXXXXXXXXX"

2. Node.js SDK实现（结合双API完成完整同步） #

如果需要用户完整详情+状态，得结合SSO Admin和IdentityStore两个接口联动：

• 先安装依赖包：

  npm install @aws-sdk/client-sso-admin @aws-sdk/client-identitystore
  

• 示例代码（直接可用，替换区域和数据库逻辑即可）：

  const { SSOAdminClient, ListUsersCommand, ListInstancesCommand } = require("@aws-sdk/client-sso-admin");
  const { IdentityStoreClient, ListUsersCommand: IdentityListUsersCommand } = require("@aws-sdk/client-identitystore");
  
  const region = "你的AWS区域";
  const ssoClient = new SSOAdminClient({ region });
  const identityStoreClient = new IdentityStoreClient({ region });
  
  async function syncUsers() {
      // 1. 获取SSO实例的ARN和关联的IdentityStore ID
      const instancesResp = await ssoClient.send(new ListInstancesCommand({}));
      const instanceArn = instancesResp.Instances[0].InstanceArn;
      const identityStoreId = instancesResp.Instances[0].IdentityStoreId;
  
      // 2. 分页拉取SSO Admin的用户数据（带状态）
      let ssoUsers = [];
      let nextToken;
      do {
          const ssoResp = await ssoClient.send(new ListUsersCommand({
              InstanceArn: instanceArn,
              NextToken: nextToken
          }));
          ssoUsers = [...ssoUsers, ...ssoResp.Users];
          nextToken = ssoResp.NextToken;
      } while (nextToken);
  
      // 3. 分页拉取IdentityStore的用户完整详情
      let identityUsers = [];
      nextToken = undefined;
      do {
          const identityResp = await identityStoreClient.send(new IdentityListUsersCommand({
              IdentityStoreId: identityStoreId,
              NextToken: nextToken
          }));
          identityUsers = [...identityUsers, ...identityResp.Users];
          nextToken = identityResp.NextToken;
      } while (nextToken);
  
      // 4. 合并两个数据源：用UserId关联，补全状态字段
      const mergedUsers = ssoUsers.map(ssoUser => {
          const matchedUser = identityUsers.find(u => u.UserId === ssoUser.UserId);
          return {
              ...matchedUser,
              Status: ssoUser.Status
          };
      });
  
      // 5. 同步到本地数据库（替换成你的数据库操作逻辑）
      console.log("待同步的用户数据：", mergedUsers);
  }
  
  // 放到cron job里定时执行即可
  syncUsers().catch(err => console.error("同步失败：", err));
  

3. 权限说明 #

执行任务的IAM身份（角色/用户）必须拥有以下权限，否则会报错：

• sso-admin:ListInstances
• sso-admin:ListUsers
• identitystore:ListUsers

参考授权策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sso-admin:ListInstances",
                "sso-admin:ListUsers",
                "identitystore:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}

内容的提问来源于stack exchange，提问作者Avinash