如何使用AWS SDK V3 JavaScript获取权限集关联策略的操作权限

核心逻辑 #

SSO权限集的权限来自两类：内嵌策略和关联的托管策略，需要分别获取这两类策略文档后，解析出其中的操作权限列表。

步骤1：初始化SDK客户端 #

先创建SSO Admin和IAM的客户端实例，注意SSO Admin客户端的区域要和你的SSO实例区域一致。

import { SSOAdminClient, DescribePermissionSetCommand, ListManagedPoliciesInPermissionSetCommand } from "@aws-sdk/client-sso-admin";
import { IAMClient, GetPolicyCommand, GetPolicyVersionCommand } from "@aws-sdk/client-iam";

// 替换为你的SSO实例所在区域
const ssoAdminClient = new SSOAdminClient({ region: "us-east-1" });
const iamClient = new IAMClient({ region: "us-east-1" });

步骤2：获取权限集的关联策略信息 #

先拿到权限集的内嵌策略，再获取所有关联的托管策略ARN列表。

async function getPermissionSetPolicySources(instanceArn, permissionSetArn) {
  // 获取权限集详情，包含内嵌策略
  const describeCmd = new DescribePermissionSetCommand({
    InstanceArn: instanceArn,
    PermissionSetArn: permissionSetArn
  });
  const describeRes = await ssoAdminClient.send(describeCmd);
  const inlinePolicy = describeRes.PermissionSet.InlinePolicy;

  // 获取关联的托管策略ARN
  const listManagedCmd = new ListManagedPoliciesInPermissionSetCommand({
    InstanceArn: instanceArn,
    PermissionSetArn: permissionSetArn
  });
  const managedRes = await ssoAdminClient.send(listManagedCmd);
  const managedPolicyArns = managedRes.AttachedManagedPolicies?.map(p => p.PolicyArn) || [];

  return { inlinePolicy, managedPolicyArns };
}

步骤3：解析策略文档中的操作权限 #

写一个通用函数，从策略文档里提取所有Effect: Allow的操作，兼容单个字符串或数组形式的Action字段。

function extractActions(policyDoc) {
  const actions = new Set();
  const policy = JSON.parse(policyDoc);

  if (!policy.Statement) return [];
  const statements = Array.isArray(policy.Statement) ? policy.Statement : [policy.Statement];

  statements.forEach(statement => {
    if (statement.Effect !== "Allow") return;
    const action = statement.Action;
    if (typeof action === "string") {
      actions.add(action);
    } else if (Array.isArray(action)) {
      action.forEach(a => actions.add(a));
    }
  });

  return Array.from(actions).sort();
}

步骤4：获取托管策略的完整文档 #

托管策略需要先获取默认版本ID，再拉取对应版本的策略文档（注意文档是URL编码的，需要解码）。

async function getManagedPolicyContent(policyArn) {
  // 获取策略默认版本ID
  const getPolicyCmd = new GetPolicyCommand({ PolicyArn: policyArn });
  const policyRes = await iamClient.send(getPolicyCmd);
  const defaultVersionId = policyRes.Policy.DefaultVersionId;

  // 获取策略版本文档
  const getVersionCmd = new GetPolicyVersionCommand({
    PolicyArn: policyArn,
    VersionId: defaultVersionId
  });
  const versionRes = await iamClient.send(getVersionCmd);
  
  return decodeURIComponent(versionRes.PolicyVersion.Document);
}

步骤5：整合逻辑，输出所有操作权限 #

把上面的函数组合起来，一次性获取权限集的所有操作。

async function listAllPermissionSetActions(instanceArn, permissionSetArn) {
  const { inlinePolicy, managedPolicyArns } = await getPermissionSetPolicySources(instanceArn, permissionSetArn);
  
  const allActions = new Set();

  // 处理内嵌策略
  if (inlinePolicy) {
    const inlineActions = extractActions(inlinePolicy);
    inlineActions.forEach(a => allActions.add(a));
  }

  // 处理每个托管策略
  for (const arn of managedPolicyArns) {
    const policyDoc = await getManagedPolicyContent(arn);
    const managedActions = extractActions(policyDoc);
    managedActions.forEach(a => allActions.add(a));
  }

  return Array.from(allActions).sort();
}

// 调用示例：替换成你的SSO实例ARN和权限集ARN
const instanceArn = "arn:aws:sso:::instance/ssoins-xxxxxx";
const permissionSetArn = "arn:aws:sso:::permissionSet/ssoins-xxxxxx/ps-xxxxxx";

listAllPermissionSetActions(instanceArn, permissionSetArn)
  .then(actions => {
    console.log("权限集拥有的操作权限：");
    actions.forEach(action => console.log(`- ${action}`));
  })
  .catch(err => {
    console.error("获取失败：", err);
  });

注意事项 #

• 执行代码的角色必须拥有以下权限：sso:DescribePermissionSet、sso:ListManagedPoliciesInPermissionSet、iam:GetPolicy、iam:GetPolicyVersion
• 如果权限集包含ABAC动态权限（基于标签/属性的条件），上述代码仅提取明确的Action，不会处理条件限制
• 策略中的通配符（如s3:*）会直接保留，如需展开具体操作需要额外处理

内容的提问来源于stack exchange，提问作者Keloo7