如何轻量化的在亚马逊云科技中国区安全使用 Transfer Family SFTP

import json
import os
import hmac
import boto3

sm = boto3.client("secretsmanager")

SECRET_ID = os.environ["SECRET_ID"]
ROLE_ARN = os.environ["ROLE_ARN"]
HOME_BUCKET = os.environ["HOME_BUCKET"]
ALLOWED_IPS = os.environ.get("ALLOWED_IPS", "").split(",")

DENY = {}

def _get_pw(stage):
    try:
        r = sm.get_secret_value(SecretId=SECRET_ID, VersionStage=stage)
        return json.loads(r["SecretString"]).get("Password", "")
    except Exception:
        return ""

def handler(event, context):
    # 日志（不记录密码）
    print(json.dumps({
        "username": event.get("username"),
        "protocol": event.get("protocol"),
        "sourceIp": event.get("sourceIp")
    }))

    if event.get("protocol") != "SFTP":
        return DENY

    # 源 IP 白名单校验
    src = event.get("sourceIp", "")
    if ALLOWED_IPS and ALLOWED_IPS[0] and src not in ALLOWED_IPS:
        return DENY

    # 强制密码登录
    presented = event.get("password", "")
    if not presented:
        return DENY

    # 同时接受当前和上一版本密码（覆盖轮换过渡期）
    for stage in ("AWSCURRENT", "AWSPREVIOUS"):
        valid = _get_pw(stage)
        if valid and hmac.compare_digest(presented, valid):
            return {
                "Role": ROLE_ARN,
                "HomeDirectoryType": "LOGICAL",
                "HomeDirectoryDetails": json.dumps([
                    {"Entry": "/", "Target": f"/{HOME_BUCKET}/users/{event['username']}"}
                ]),
            }

    return DENY