如何在boto3中遍历嵌套结构，筛选含指定标签的VPC端点？

问题背景 #

需要遍历boto3返回的VPC端点嵌套字典与列表结构，检索是否存在标签键为AWSNetworkFirewallManaged且值匹配true（含大小写变体）的标签，现有代码存在错误，无法完成需求。

响应数据示例 #

response = {
    "VpcEndpoints": [
        {
            "VpcEndpointId": "vpce-123",
            "VpcEndpointType": "GatewayLoadBalancer",
            "VpcId": "vpc-test",
            "ServiceName": "com.amazonaws.com",
            "State": "available",
            "SubnetIds": [
                "subnet-random"
            ],
            "IpAddressType": "ipv4",
            "RequesterManaged": true,
            "NetworkInterfaceIds": [
                "eni-123"
            ],
            "CreationTimestamp": "2022-10-28T01:23:23.924Z",
            "Tags": [
                {
                    "Key": "AWSNetworkFirewallManaged",
                    "Value": "true"
                },
                {
                    "Key": "Firewall",
                    "Value": "arn:aws:network-firewall:us-west-2"
                }
            ],
            "OwnerId": "123"
        },
        {
            "VpcEndpointId": "vpce-456",
            "VpcEndpointType": "GatewayLoadBalancer",
            "VpcId": "vpc-<value>",
            "ServiceName": "com.amazonaws.vpce.us-west-2",
            "State": "available",
            "SubnetIds": [
                "subnet-<number>"
            ],
            "IpAddressType": "ipv4",
            "RequesterManaged": true,
            "NetworkInterfaceIds": [
                "eni-<value>"
            ],
            "CreationTimestamp": "2022-10-28T01:23:42.113Z",
            "Tags": [
                {
                    "Key": "AWSNetworkFirewallManaged",
                    "Value": "True"
                },
                {
                    "Key": "Firewall",
                    "Value": "arn:aws:network-firewall:%l"
                }
            ],
            "OwnerId": "random"
        }
    ]
}

现有代码错误分析 #

现有代码存在两处明显错误：

1. endpoint['VpcEndpointId']['Tags']：VpcEndpointId是字符串类型的端点ID，并非字典，无法通过['Tags']访问标签；
2. print语句缺少右括号，存在语法错误。

正确解决方案 #

以下代码可遍历所有VPC端点，检查目标标签并收集符合条件的端点ID：

# 假设DESCRIBE_VPC_ENDPOINTS为boto3返回的响应字典
managed_endpoints = []

for endpoint in DESCRIBE_VPC_ENDPOINTS['VpcEndpoints']:
    endpoint_id = endpoint['VpcEndpointId']
    # 遍历当前端点的标签，用get避免无Tags时抛出KeyError
    for tag in endpoint.get('Tags', []):
        # 匹配标签键，并忽略值的大小写（兼容true/True）
        if tag['Key'] == 'AWSNetworkFirewallManaged' and tag['Value'].lower() == 'true':
            managed_endpoints.append(endpoint_id)
            break  # 找到匹配标签后跳出循环，避免重复添加

# 输出结果
print("AWS Network Firewall管理的VPC端点：")
for ep_id in managed_endpoints:
    print(ep_id)

代码说明 #

• 使用endpoint.get('Tags', [])处理无标签的端点，避免KeyError；
• 值匹配时忽略大小写，兼容示例中true和True的不同写法；
• 找到匹配标签后立即跳出标签循环，提升遍历效率。

内容的提问来源于stack exchange，提问作者Lam2020