How to find the AWS account ID of any S3 bucket • Hacker News Board

Re: How to find the AWS account ID of any S3 bucket

#21

Post by abadpoli » Mon, Feb 26, 2024, 5:01 PM UTC

electroly wrote: post #17

abadpoli wrote: post #8

Earlier quoted context omitted.

AWS Account IDs are not secret and don’t need to be. AWS doesn’t design anything that assumes your account ID is secret, and you shouldn’t either.

While I agree, the way you wrote this might mislead people into thinking that you meant you can treat your account ID as non-secret because AWS does. That doesn't directly follow; the difference between AWS's point of view and your company's point of view means there are things you might care about that AWS does not. Rather, you need to follow AWS's lead and design your cloud deployment such that the account ID doesn…

No, this is wrong. The fact that AWS does not consider the ID a secret means that your company never should either. If your company “cares” about its ID being secret, then your company is designing its systems in an insecure way.

The fact that AWS does not treat the ID as secret means you have no guarantees that anyone within AWS cannot see or find your ID. You also have no guarantee that AWS at some point won’t expose your ID to the world and break your entire security model, because AWS doesn’t think it’s secret. If you do, you’re basing your security off of false assumptions.

Re: How to find the AWS account ID of any S3 bucket

#22

Post by electroly » Mon, Feb 26, 2024, 5:02 PM UTC

abadpoli wrote: post #21

electroly wrote: post #17

Earlier quoted context omitted.

While I agree, the way you wrote this might mislead people into thinking that you meant you can treat your account ID as non-secret because AWS does. That doesn't directly follow; the difference between AWS's point of view and your company's point of view means there are things you might care about that AWS does not. Rather, you need to follow AWS's lead and design your cloud deployment such that the account ID doesn…

No, this is wrong. The fact that AWS does not consider the ID a secret means that your company never should either. If your company “cares” about its ID being secret, then your company is designing its systems in an insecure way. The fact that AWS does not treat the ID as secret means you have no guarantees that anyone within AWS cannot see or find your ID. You also have no guarantee that AWS at some point won’t expo…

You've said "this is wrong" and then repeated exactly my point back to me. I suspect some misunderstanding has occurred here. We are agreeing on this--you need to follow AWS's lead and design your cloud deployment such that the account ID doesn't leak anything interesting about your business. That's a direct quote from my original post. I further gave an example--if you're a design firm using a single account for different clients, you're leaking the information that they are your customers. Better split it up into separate accounts to preserve the non-secretness of the account ID--another direct quote from my original post.

Stated another way: you can unintentionally make your account ID sensitive if you're not careful. You have to be careful.

Re: How to find the AWS account ID of any S3 bucket

#23

Post by abadpoli » Mon, Feb 26, 2024, 5:02 PM UTC

TheIronMark wrote: post #19

abadpoli wrote: post #8

Earlier quoted context omitted.

AWS Account IDs are not secret and don’t need to be. AWS doesn’t design anything that assumes your account ID is secret, and you shouldn’t either.

AWS doesn't consider them sensitive, but some organizations do. My feeling is that I would rather avoid leaking any info about my AWS environments. Just because AWS doesn't think they can be dangerous doesn't mean someone else won't find a way.

And those organizations are building their security model off of false assumptions, and are wrong.

Re: How to find the AWS account ID of any S3 bucket

#24

Post by jameshart » Mon, Feb 26, 2024, 5:05 PM UTC

> The ability to apply a wildcard match on the s3:ResourceAccount condition key

That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.

Re: How to find the AWS account ID of any S3 bucket

#25

Post by mschuster91 » Mon, Feb 26, 2024, 5:08 PM UTC

anamexis wrote: post #20

mschuster91 wrote: post #18

Earlier quoted context omitted.

> AWS account ID is also safe to be public. Not necessarily. An AWS account ID + the knowledge of a role name that by mistake has the "allow role assumption" allowlist too wide (say "*") is now enough to take over the account. One might of course say "well then don't do that", but of course the more complex a system like IAM is the easier it is for unexperienced people to open the floodgates.

Well sure, but your account email isn't safe to be public if your password is "password".

Email providers have rate limits against specific user logins, IAM not.

Re: How to find the AWS account ID of any S3 bucket

#26

Post by akerl_ » Mon, Feb 26, 2024, 5:09 PM UTC

samstave wrote: post #4

So are S3 Crawler bots inbound that will be used to exploit and blackmail S3 bucket owners... via doxxing? EDIT: isnt one of the S's "secure".... Isnt it like THE FIRST S?!?!?!? EDIT I get it! - I forgot the three Ss'! Shove it.

No. None of the Ss in S3 stand for Secure.

And this still doesn’t let you tie an account ID to an email or human.

Re: How to find the AWS account ID of any S3 bucket

#27

Post by mschuster91 » Mon, Feb 26, 2024, 5:09 PM UTC

abadpoli wrote: post #23

TheIronMark wrote: post #19

Earlier quoted context omitted.

AWS doesn't consider them sensitive, but some organizations do. My feeling is that I would rather avoid leaking any info about my AWS environments. Just because AWS doesn't think they can be dangerous doesn't mean someone else won't find a way.

And those organizations are building their security model off of false assumptions, and are wrong.

Defense in depth, always assume that anything can get used as an attack vector including AWS itself.

Re: How to find the AWS account ID of any S3 bucket

#28

Post by jameshart » Mon, Feb 26, 2024, 5:10 PM UTC

ianhawes wrote: post #2

TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.

AWS account IDs aren’t secret, but the identity of who owns particular S3 bucket names is meant to be.

If you get an email apparently from AWS that correctly names an S3 bucket and the associated account ID, are you more likely to take it seriously than an email that just names a bucket?

Re: How to find the AWS account ID of any S3 bucket

#29

Post by dekhn » Mon, Feb 26, 2024, 5:10 PM UTC

mschuster91 wrote: post #18

abadpoli wrote: post #9

Earlier quoted context omitted.

AWS account ID is also safe to be public. That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites from the same AWS account, people would be able to see that they’re hosted by the same account. Whether or not this matters depends on your threat model.

> AWS account ID is also safe to be public. Not necessarily. An AWS account ID + the knowledge of a role name that by mistake has the "allow role assumption" allowlist too wide (say "*") is now enough to take over the account. One might of course say "well then don't do that", but of course the more complex a system like IAM is the easier it is for unexperienced people to open the floodgates.

Turning what you said around, you're arguing you might want to keep an account ID secret for "security by obscurity" reasons. In my mind, even in a multi-layer security solution, even then the account ID should be considered as a public string whose knowledge (along with other bits like what misconfigurations it has) provides no additional vector of attack, because of defense in depth.

Re: How to find the AWS account ID of any S3 bucket

#30

Post by afavour » Mon, Feb 26, 2024, 5:17 PM UTC

jameshart wrote: post #28

ianhawes wrote: post #2

TIL: AWS Account IDs are considered secrets. IMO, if a given value cannot be cycled, it is sensitive but not secret.

AWS account IDs aren’t secret, but the identity of who owns particular S3 bucket names is meant to be. If you get an email apparently from AWS that correctly names an S3 bucket and the associated account ID, are you more likely to take it seriously than an email that just names a bucket?

Not to mention it also means you can establish relationships between buckets by finding common ownership.

No, the account ID isn’t secret but I don’t think we should be dismissive of this new information either. It’s still important metadata to factor into decision making.