Python从AWS GuardDuty获取特定的JSON值

时间:2018-05-24 18:37:39

标签: python json amazon-web-services aws-lambda

我在AWS Lambda上编写了一些代码,我试图从GuardDuty的调查结果中提取IP。我已经获得了FindingIds,但是当我尝试提取IP地址时,我收到以下错误:

  

{“errorMessage”:“列表索引必须是整数或切片,而不是   str“,”errorType“:”TypeError“,”stackTrace“:[       [         “/var/task/lambda_function.py”         38,         “lambda_handler”         “打印(loadFindings [ '发现'] [ '资源'] [ 'NetworkInterfaces'] [ 'PublicIp'])”       ]]}

到目前为止,我的完整代码如下:

import json
import boto3
from pprint import pprint # Pretty-print for displaying the JSON nicely.

#pprint(listOfFindings)

def lambda_handler(event, context):
    client = boto3.client('guardduty') # Creating the client.
    Det_ID = '5ab1b6808e98faaabd947a01af9ed970' # Setting the Detect ID for GD.
    response = client.list_findings(DetectorId=Det_ID) # Gathering all findings... Need to filter.
    findings = json.dumps(response) # Dumping the JSON findings
    listOfFindings = json.loads(findings) # Making them into a readable format for Python.
    # print("Here's the IDs!",listOfFindings['FindingIds'],"\n\n\n") # Printing all Finding IDs.

    idPosition=0
    idList = []
    for id in listOfFindings['FindingIds']: # Looping through all the Finding IDs. 
        #print("\n\n\nNumber", x, listOfFindings['FindingIds'][x]) # Prints all the Finding Ids separated.
        idList.append(listOfFindings['FindingIds'][idPosition])
        idPosition+=1

    # print("TEST") - Debugging.
    # print(idList) - Debugging.

    findingsList = []
    position = 0
    for ids in idList:
        # print(idList[position])
        stringFindingId = str(idList[position])
        #stringFindingId = idList[position]
        allFindings = client.get_findings(
            DetectorId=Det_ID,
            FindingIds=[
                stringFindingId,])
        dumpFindings = json.dumps(allFindings)
        loadFindings = json.loads(dumpFindings)
        # findingsList.append(loadFindings)
        print(loadFindings['Findings']['Resource']['NetworkInterfaces']['PublicIp']) # BROKEN HERE
        position += 1

非常感谢任何帮助!

1 个答案:

答案 0 :(得分:0)

docs表示'Findings'的值是字典列表。因此,要么只使用allFindings['Findings'][0](如果列表中只有一个项目),要么循环使用allFindings['Findings']

顺便说一句,这段代码毫无意义:

    dumpFindings = json.dumps(allFindings)
    loadFindings = json.loads(dumpFindings)