Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

61–70 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#61

Post by sroussey »

abadpoli wrote: post #21
electroly wrote: post #17

Earlier quoted context omitted.

While I agree, the way you wrote this might mislead people into thinking that you meant you can treat your account ID as non-secret because AWS does. That doesn't directly follow; the difference between AWS's point of view and your company's point of view means there are things you might care about that AWS does not. Rather, you need to follow AWS's lead and design your cloud deployment such that the account ID doesn…

No, this is wrong. The fact that AWS does not consider the ID a secret means that your company never should either. If your company “cares” about its ID being secret, then your company is designing its systems in an insecure way. The fact that AWS does not treat the ID as secret means you have no guarantees that anyone within AWS cannot see or find your ID. You also have no guarantee that AWS at some point won’t expo…

No, this is wrong. Just because it is not a secret does not mean that is disclosure is not valuable. You need that information to compromise it.

It narrows all the possible account IDs to one.

Is that ID already compromised? Can you gain access through someone else that does the work for you?

You can cross reference with other systems you have compromised. Is that account ID in their system? What access does that give you?

Etc, etc. It is not a secret, but it absolutely is valuable.

For example, if you considered it a secret (even though it is not), you might not choose to use third parties that require it, and that can improve your security posture.

Re: How to find the AWS account ID of any S3 bucket

#62

Post by twoodfin »

efitz wrote: post #41
jameshart wrote: post #24

> The ability to apply a wildcard match on the s3:ResourceAccount condition key That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

Re: How to find the AWS account ID of any S3 bucket

#63

Post by pc86 »

sroussey wrote: post #56
efitz wrote: post #41

Earlier quoted context omitted.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

Well, that assumes that the ID is cryptographically random. Perhaps that is a bad assumption.

Even if it's not that doesn't mean pattern matching IDs is good.

Re: How to find the AWS account ID of any S3 bucket

#64

Post by dclowd9901 »

twoodfin wrote: post #62
efitz wrote: post #41

Earlier quoted context omitted.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

Can you even block off IDs like this?

Re: How to find the AWS account ID of any S3 bucket

#65

Post by laserlight »

abadpoli wrote: post #46
laserlight wrote: post #38

Earlier quoted context omitted.

I don't understand your reasoning. Neither my name nor where I live nor my phone number nor my license plate are secrets. Yet I don't go around wearing a t-shirt with my personally identifying information printed on it. What am I missing?

If you knew that there was an assassin out there trying to find you and cause you harm, would you consider “I don’t wear a t-shirt with my address on it” to be any form of protection against that assassin? If you want protection against that, you need to focus on better home security, hiring bodyguards, going to the police etc, and you’re better off assuming that the assassin will find your address regardless of whet…

> Put another way: there’s a difference between “I don’t do this thing” and “I rely on not doing this thing for my safety”.

That was my point. The fact that some organizations consider AWS account IDs sensitive is independent of whether they rely on it being sensitive or not.

I might have taken all precautions against an assassin attack, yet I won't make the assassin's job easier by announcing my PII to them. The fact that I won't announce my PII says nothing about whether I took the security precautions.

Re: How to find the AWS account ID of any S3 bucket

#66

Post by dclowd9901 »

sroussey wrote: post #56
efitz wrote: post #41

Earlier quoted context omitted.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

Well, that assumes that the ID is cryptographically random. Perhaps that is a bad assumption.

If it's sequential, that somehow seems worse?

Re: How to find the AWS account ID of any S3 bucket

#67

Post by ejb999 »

tuananh wrote: post #45

aws s3 bucket needs to match the domain for website hosting. let's say if apple uses s3, they need to create bucket name "apple.com", and then we can find what aws account which apple is using.

Not exactly - they Can do that, but they don't need to match - using cloudfront in front of your s3 website and then the site can be served from any bucket or folder within a bucket.

I have dozens of s3 static websites served from a single s3 bucket, all with unique top-level domains, each in its own folder within that single bucket - much easier this way.

Given anyone can create a bucket with any name (if its not already in use), you can't count on getting the bucket name that matches your domain name.

Re: How to find the AWS account ID of any S3 bucket

#68

Post by tempay »

dclowd9901 wrote: post #64
twoodfin wrote: post #62

Earlier quoted context omitted.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

Can you even block off IDs like this?

If you’re big enough to need it I’m sure it can be arranged.

Re: How to find the AWS account ID of any S3 bucket

#69

Post by x3n0ph3n3 »

twoodfin wrote: post #62
efitz wrote: post #41

Earlier quoted context omitted.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

At that point you should be using AWS Organizations and OUs.
Post reply on HN