Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

81–90 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#81

Post by abadpoli »

laserlight wrote: post #65
abadpoli wrote: post #46

Earlier quoted context omitted.

If you knew that there was an assassin out there trying to find you and cause you harm, would you consider “I don’t wear a t-shirt with my address on it” to be any form of protection against that assassin? If you want protection against that, you need to focus on better home security, hiring bodyguards, going to the police etc, and you’re better off assuming that the assassin will find your address regardless of whet…

> Put another way: there’s a difference between “I don’t do this thing” and “I rely on not doing this thing for my safety”. That was my point. The fact that some organizations consider AWS account IDs sensitive is independent of whether they rely on it being sensitive or not. I might have taken all precautions against an assassin attack, yet I won't make the assassin's job easier by announcing my PII to them. The fac…

If an organization considers it sensitive, that implies they’re putting some level of reliance on it being so. Otherwise there would be no point in considering it sensitive.

There’s a difference between “making it easier for an attacker” and using it as a security control, even if it’s not the only security control. The point is that even if you don’t go around wearing a shirt with your address on it, that should never factor in to your designs for security. It should never be considered a security control, even a “defense in depth” one.

In fact, your threat model should ideally ask the question “assume someone does walk around with a shirt with my address on it, will I still be safe?” That doesn’t mean you’re actually going to go do it, but if the answer is yes, that’s how you know you’ve done your job.

Re: How to find the AWS account ID of any S3 bucket

#82

Post by dimitrios1 »

cj wrote: post #70

> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...

Seems like at least in the digital world, there is either public or private information, and that's it. We don't really have a good concept of privilege or protected information.

For example, my home address is technically public, but I most certainly wouldn't want it lambasted across the interstate with a picture of my family next to it advertising where I live. It's handed out on a need-to-know basis, and I mostly trust / expect that it's kept mostly confidential, or use-limited.

Re: How to find the AWS account ID of any S3 bucket

#83

Post by jkaplowitz »

belter wrote: post #34
tracebit wrote: post #10

For those interested, we put the code online here: https://github.com/tracebit-com/find-s3-account

I am not sure this would be in agreement with these policies, or at least the spirit of them: https://aws.amazon.com/security/penetration-testing/

OP's article said they consulted with Amazon's security team before publishing, so I imagine they know what's allowed in this case.

Re: How to find the AWS account ID of any S3 bucket

#84

Post by pyre »

panarky wrote: post #80
cj wrote: post #70

> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...

What does this mean? If they're not secret, sensitive, or confidential, then why must they be shared carefully?

There is plenty of information that you wouldn't necessarily want to publish, but wouldn't be the end of the world if it were leaked either.

Re: How to find the AWS account ID of any S3 bucket

#86

Post by rmbyrro »

panarky wrote: post #80
cj wrote: post #70

> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...

What does this mean? If they're not secret, sensitive, or confidential, then why must they be shared carefully?

Usually, the more information an attacker has about you, the higher the chances of coming up with a successful attack vector.

Re: How to find the AWS account ID of any S3 bucket

#87

Post by greiskul »

dimitrios1 wrote: post #82
cj wrote: post #70

> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...

Seems like at least in the digital world, there is either public or private information, and that's it. We don't really have a good concept of privilege or protected information. For example, my home address is technically public, but I most certainly wouldn't want it lambasted across the interstate with a picture of my family next to it advertising where I live. It's handed out on a need-to-know basis, and I mostly…

One huge mistake that Google did when they were integrating youtube with Google+, was the idea of sharing people's youtube comments with their G+ friends. Youtube comments have always been public, but there was huge customer pushback, forcing them to revert them for this idea, since there is in people's mind a huge difference between public and publicized comments.

Re: How to find the AWS account ID of any S3 bucket

#88

Post by vegardx »

bjw4 wrote: post #78

Any tips on how to do the same for EC2 instances? Am aware of one that’s allegedly joined to our domain but can’t find it in any owned accounts

If you're lucky and it has a instance profile attached with appropriate role/policy attached you can use get caller identity to see what account it's running in: https://docs.aws.amazon.com/cli/latest/reference/sts/get-cal...

Re: How to find the AWS account ID of any S3 bucket

#89

Post by rad_gruchalski »

rmbyrro wrote: post #86
panarky wrote: post #80

Earlier quoted context omitted.

What does this mean? If they're not secret, sensitive, or confidential, then why must they be shared carefully?

Usually, the more information an attacker has about you, the higher the chances of coming up with a successful attack vector.

„So let’s give them an API to make their job easier!”

Re: How to find the AWS account ID of any S3 bucket

#90

Post by johnklos »

jameshart wrote: post #24

> The ability to apply a wildcard match on the s3:ResourceAccount condition key That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.

This is like matching a bitfield on the group ID on a Unix system. I could see someone coming up with this idea, and I could see them thinking this is somehow smart, but implementing it on systems that aren't 100% in your control would just be silly.
Post reply on HN