Will it make it easier to identify the operators of malvertising campaigns hosted on AWS?
Doubt they use their real information on their AWS accounts.
How to find the AWS account ID of any S3 bucket
71–80 of 227 posts
Re: How to find the AWS account ID of any S3 bucket
#72[flagged]
Re: How to find the AWS account ID of any S3 bucket
#73Earlier quoted context omitted.
That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.
If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.
If there are a lot of them and there is a b-tree index somewhere you might find it useful to scan them in alphabetical order.
Re: How to find the AWS account ID of any S3 bucket
#74Earlier quoted context omitted.
That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.
Well, that assumes that the ID is cryptographically random. Perhaps that is a bad assumption.
My general assumption is not that they’re random, but at least that they’re not correlated; in particular that Amazon is not in the habit of handing out, like, account IDs 676363687000 - 676363687999 to a single organization. Even if they did hand out a sequential batch of 1000 account IDs, it would be more likely to be 676363687541 - 676363688540 than a set with a single consistent prefix.
Odds are that an account wildcard match like 676363687* will just match a few hundred entirely random AWS accounts.
Re: How to find the AWS account ID of any S3 bucket
#75Earlier quoted context omitted.
If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.
At that point you should be using AWS Organizations and OUs.
I think the GP is talking about granting access to a particular bucket to an unbounded number of customer AWS accounts — probably in requester-pays config. (Think: static data used by an Amazon Marketplace virtual appliance.)
Re: How to find the AWS account ID of any S3 bucket
#76> The ability to apply a wildcard match on the s3:ResourceAccount condition key That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.
Probably comes out of a tendency to generalize. Last week for one of my side projects I built something that lets you write queries in a format inspired by OWL and it has a library of relational operators that can, say, extract the host from a URL or do a prefix query, like query, regex query, etc.
As it is my side project’s side project I do what is easy so these operators are always available even in cases where they don’t make sense (I dunno what happens if you try a regex query on a number, I don’t care) I can imagine there is something a bit like this inside AWS but for a security-sensitive system with a lot of users you have a different standard.
Re: How to find the AWS account ID of any S3 bucket
#77aws s3 bucket needs to match the domain for website hosting. let's say if apple uses s3, they need to create bucket name "apple.com", and then we can find what aws account which apple is using.
> aws s3 bucket needs to match the domain for website hosting.
This is outdated information, and not required anymore when using CloudFront.
And even in the past, you could use the S3 API to implement a reverse proxy without matching bucket and domain names.
Re: How to find the AWS account ID of any S3 bucket
#78Any tips on how to do the same for EC2 instances? Am aware of one that’s allegedly joined to our domain but can’t find it in any owned accounts
Re: How to find the AWS account ID of any S3 bucket
#79How might this matter? A obvious one: Given a production bucket, it’s now possible to find development buckets for that same org, which is not expected behavior IMO.
Only true if they use the same accounts for both production and development. This would be another reason not to use the same accounts.
Re: How to find the AWS account ID of any S3 bucket
#80> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...
What does this mean?
If they're not secret, sensitive, or confidential, then why must they be shared carefully?