How to find the AWS account ID of any S3 bucket
tracebit.com
How to find the AWS account ID of any S3 bucket
1–10 of 227 posts
Re: How to find the AWS account ID of any S3 bucket
#2TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.
Re: How to find the AWS account ID of any S3 bucket
#3TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.
AWS do not define account IDs as a secret (https://docs.aws.amazon.com/accounts/latest/reference/manage...) but until now it's not been possible to do this look up.
Re: How to find the AWS account ID of any S3 bucket
#4So are S3 Crawler bots inbound that will be used to exploit and blackmail S3 bucket owners... via doxxing?
EDIT: isnt one of the S's "secure"....
Isnt it like THE FIRST S?!?!?!?
EDIT
I get it! - I forgot the three Ss'!
Shove it.
Re: How to find the AWS account ID of any S3 bucket
#5Slightly related - CloudFlare account_id and zone_id are safe to be public
https://github.com/cloudflare/cloudflare-docs/issues/474
https://community.cloudflare.com/t/api-zone-id/355566
> The Zone ID and Account ID are not sensitive. Sensitive data like account API Key, Secrets etc. can all be revoked, rotated or changed. See the comment 36 below on the Wrangler repo: as per our security team, it’s completely Fine to have your zone_id and account_id public, the Global API key and associated email address should be kept secret.
Re: How to find the AWS account ID of any S3 bucket
#6So are S3 Crawler bots inbound that will be used to exploit and blackmail S3 bucket owners... via doxxing? EDIT: isnt one of the S's "secure".... Isnt it like THE FIRST S?!?!?!? EDIT I get it! - I forgot the three Ss'! Shove it.
[deleted]
Re: How to find the AWS account ID of any S3 bucket
#7For sure an interesting find, but was kinda hoping based on the title that there was a more straightforward way to do this.
I really wish that AWS had a simple way from an admin account to ask "where is X resource" within an organization to quickly tell me which account has a specific S3 bucket (and other things, but s3 buckets is the big one).
Admittedly this is mostly an issue with legacy buckets that existed before better practices and buckets all being defined in code. But with a ton of AWS accounts it can be tedious to hunt down a resource in an unknown account and possibly region.
Re: How to find the AWS account ID of any S3 bucket
#8TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.
AWS Account IDs are not secret and don’t need to be. AWS doesn’t design anything that assumes your account ID is secret, and you shouldn’t either.
Re: How to find the AWS account ID of any S3 bucket
#9Slightly related - CloudFlare account_id and zone_id are safe to be public https://github.com/cloudflare/cloudflare-docs/issues/474 https://community.cloudflare.com/t/api-zone-id/355566 > The Zone ID and Account ID are not sensitive. Sensitive data like account API Key, Secrets etc. can all be revoked, rotated or changed. See the comment 36 below on the Wrangler repo: as per our security team, it’s completely Fine to…
AWS account ID is also safe to be public.
That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites from the same AWS account, people would be able to see that they’re hosted by the same account. Whether or not this matters depends on your threat model.
Re: How to find the AWS account ID of any S3 bucket
#10For those interested, we put the code online here: https://github.com/tracebit-com/find-s3-account