Can we go further, and find the email associated with an account ID?
How to find the AWS account ID of any S3 bucket
11–20 of 227 posts
Re: How to find the AWS account ID of any S3 bucket
#12So are S3 Crawler bots inbound that will be used to exploit and blackmail S3 bucket owners... via doxxing? EDIT: isnt one of the S's "secure".... Isnt it like THE FIRST S?!?!?!? EDIT I get it! - I forgot the three Ss'! Shove it.
Exploiting incorrect/weak IAM permissions I would assume.
Re: How to find the AWS account ID of any S3 bucket
#13Slightly related - CloudFlare account_id and zone_id are safe to be public https://github.com/cloudflare/cloudflare-docs/issues/474 https://community.cloudflare.com/t/api-zone-id/355566 > The Zone ID and Account ID are not sensitive. Sensitive data like account API Key, Secrets etc. can all be revoked, rotated or changed. See the comment 36 below on the Wrangler repo: as per our security team, it’s completely Fine to…
AWS account ID is also safe to be public. That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites from the same AWS account, people would be able to see that they’re hosted by the same account. Whether or not this matters depends on your threat model.
Exactly - this isn't going to open the door for someone but could add a ton of value to enumeration.
As we are very canary focused, we also think it's interesting to consider the implications of the recent research from Truffle Security w.r.t canary tokens (https://trufflesecurity.com/blog/canaries).
Re: How to find the AWS account ID of any S3 bucket
#14TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.
AWS Account IDs are not secret and don’t need to be. AWS doesn’t design anything that assumes your account ID is secret, and you shouldn’t either.
I've gotten in long arguments with senior IT people who refuse to believe this even when they talk to AWS directly about it.
Re: How to find the AWS account ID of any S3 bucket
#15So are S3 Crawler bots inbound that will be used to exploit and blackmail S3 bucket owners... via doxxing? EDIT: isnt one of the S's "secure".... Isnt it like THE FIRST S?!?!?!? EDIT I get it! - I forgot the three Ss'! Shove it.
No. Simple Storage Service
Re: How to find the AWS account ID of any S3 bucket
#16So are S3 Crawler bots inbound that will be used to exploit and blackmail S3 bucket owners... via doxxing? EDIT: isnt one of the S's "secure".... Isnt it like THE FIRST S?!?!?!? EDIT I get it! - I forgot the three Ss'! Shove it.
Of S3?
No, it's Simple. Simple Storage Service
Re: How to find the AWS account ID of any S3 bucket
#17TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.
AWS Account IDs are not secret and don’t need to be. AWS doesn’t design anything that assumes your account ID is secret, and you shouldn’t either.
While I agree, the way you wrote this might mislead people into thinking that you meant you can treat your account ID as non-secret because AWS does. That doesn't directly follow; the difference between AWS's point of view and your company's point of view means there are things you might care about that AWS does not. Rather, you need to follow AWS's lead and design your cloud deployment such that the account ID doesn't leak anything interesting about your business that you'd prefer to keep private. Correlated ownership of buckets (e.g. different clients of the same design firm) in particular is something AWS doesn't care about, but you might. If you don't want people to know that the buckets have the same owner, better split it up into separate accounts to preserve the non-secretness of the account ID.
Re: How to find the AWS account ID of any S3 bucket
#18Slightly related - CloudFlare account_id and zone_id are safe to be public https://github.com/cloudflare/cloudflare-docs/issues/474 https://community.cloudflare.com/t/api-zone-id/355566 > The Zone ID and Account ID are not sensitive. Sensitive data like account API Key, Secrets etc. can all be revoked, rotated or changed. See the comment 36 below on the Wrangler repo: as per our security team, it’s completely Fine to…
AWS account ID is also safe to be public. That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites from the same AWS account, people would be able to see that they’re hosted by the same account. Whether or not this matters depends on your threat model.
> AWS account ID is also safe to be public.
Not necessarily. An AWS account ID + the knowledge of a role name that by mistake has the "allow role assumption" allowlist too wide (say "*") is now enough to take over the account.
One might of course say "well then don't do that", but of course the more complex a system like IAM is the easier it is for unexperienced people to open the floodgates.
Re: How to find the AWS account ID of any S3 bucket
#19TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.
AWS Account IDs are not secret and don’t need to be. AWS doesn’t design anything that assumes your account ID is secret, and you shouldn’t either.
AWS doesn't consider them sensitive, but some organizations do. My feeling is that I would rather avoid leaking any info about my AWS environments. Just because AWS doesn't think they can be dangerous doesn't mean someone else won't find a way.
Re: How to find the AWS account ID of any S3 bucket
#20Earlier quoted context omitted.
AWS account ID is also safe to be public. That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites from the same AWS account, people would be able to see that they’re hosted by the same account. Whether or not this matters depends on your threat model.
> AWS account ID is also safe to be public. Not necessarily. An AWS account ID + the knowledge of a role name that by mistake has the "allow role assumption" allowlist too wide (say "*") is now enough to take over the account. One might of course say "well then don't do that", but of course the more complex a system like IAM is the easier it is for unexperienced people to open the floodgates.
Well sure, but your account email isn't safe to be public if your password is "password".