Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

101–110 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#101

Post by catlifeonmars »

TheIronMark wrote: post #19
abadpoli wrote: post #8

Earlier quoted context omitted.

AWS Account IDs are not secret and don’t need to be. AWS doesn’t design anything that assumes your account ID is secret, and you shouldn’t either.

AWS doesn't consider them sensitive, but some organizations do. My feeling is that I would rather avoid leaking any info about my AWS environments. Just because AWS doesn't think they can be dangerous doesn't mean someone else won't find a way.

I think making the assumption that account IDs won’t leak is the problem. It’s safer to assume that someone out there already has a directory of account IDs to buckets and that your efforts are better expended on other things, like actual secrets.

Re: How to find the AWS account ID of any S3 bucket

#102

Post by tracebit »

belter wrote: post #91
jkaplowitz wrote: post #83

Earlier quoted context omitted.

OP's article said they consulted with Amazon's security team before publishing, so I imagine they know what's allowed in this case.

It says he consulted but does not say what was their answer. I can't imagine it was a thumbs up, probably an embarrassed silence?

Yes, for the avoidance of doubt - we got the OK from AWS to publish this research

Re: How to find the AWS account ID of any S3 bucket

#103

Post by kube-system »

junon wrote: post #48
laserlight wrote: post #38

Earlier quoted context omitted.

I don't understand your reasoning. Neither my name nor where I live nor my phone number nor my license plate are secrets. Yet I don't go around wearing a t-shirt with my personally identifying information printed on it. What am I missing?

If you place any sort of security assumptions on AWS account IDs into your threat model, you're effectively directly introducing a security vulnerability. If you're not then why include it into your security threat model to begin with? I believe that is their point. Since AWS does not, and has never, treated that information as secret, then there is absolutely no reason to consider it sensitive because there is no se…

This is a false dichotomy. There is a deep chasm between "publish everything", and "this is a secret", called operational security.

Any time a topic like this comes up, there are people on this forum that try to apply the "security by obscurity does not work" principle to every security topic under the sun, when in reality, that principle really only applies to the world of cryptography. In meat space, where humans operate on plaintext, keeping a secret is a very valid approach to some topics. This is why things like NDAs exist.

Re: How to find the AWS account ID of any S3 bucket

#104

Post by 0xbadcafebee »

panarky wrote: post #80
cj wrote: post #70

> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...

What does this mean? If they're not secret, sensitive, or confidential, then why must they be shared carefully?

A hacker can enumerate the resources of and access to an account by using its account ID. Many AWS customers incorrectly configure resources such that any other AWS customer can access things in their AWS account; for example, some 3rd party providers tell customers to configure access for the 3rd party, that can lead to wide-open access for anyone who knows the customer's account ID. If the cloud admins don't know what they're doing it can be very easy to screw up and not realize it.

It's sort of like giving someone your IP address. By itself it's not enough to hack someone. But if your host is insecure, it sure makes it easier knowing exactly where to attack.

Re: How to find the AWS account ID of any S3 bucket

#105

Post by nerdjon »

emilburzo wrote: post #33
nerdjon wrote: post #7

For sure an interesting find, but was kinda hoping based on the title that there was a more straightforward way to do this. I really wish that AWS had a simple way from an admin account to ask "where is X resource" within an organization to quickly tell me which account has a specific S3 bucket (and other things, but s3 buckets is the big one). Admittedly this is mostly an issue with legacy buckets that existed befor…

If you use AWS config setup for the organization (aggregator), you'll get a athena-sql-queryable inventory of all your resources from all organization accounts. So finding out which account owns a resource can be as simple as, roughly: select accountId where arn = "x"

... how did I not know this existed.

That is exactly how we are setup, the amount of time I just spent going account by account looking for a specific resource.

Thank you! I have long wondered why it didn't exist, and apparently it did...

Re: How to find the AWS account ID of any S3 bucket

#106

Post by mellutussa »

greiskul wrote: post #87
dimitrios1 wrote: post #82

Earlier quoted context omitted.

Seems like at least in the digital world, there is either public or private information, and that's it. We don't really have a good concept of privilege or protected information. For example, my home address is technically public, but I most certainly wouldn't want it lambasted across the interstate with a picture of my family next to it advertising where I live. It's handed out on a need-to-know basis, and I mostly…

One huge mistake that Google did when they were integrating youtube with Google+, was the idea of sharing people's youtube comments with their G+ friends. Youtube comments have always been public, but there was huge customer pushback, forcing them to revert them for this idea, since there is in people's mind a huge difference between public and publicized comments.

Yep, that and other things like reviews wm you did went straight to your Google+ page.

I really wanted G+ to work, but they were just too stupid to understand that this was a deal-breaker.

Re: How to find the AWS account ID of any S3 bucket

#107

Post by thekevan »

panarky wrote: post #80
cj wrote: post #70

> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...

What does this mean? If they're not secret, sensitive, or confidential, then why must they be shared carefully?

My personal phone number is not exactly secret or confidential, but I only share it carefully.

Re: How to find the AWS account ID of any S3 bucket

#108

Post by corytheboyd »

ed wrote: post #47

How might this matter? A obvious one: Given a production bucket, it’s now possible to find development buckets for that same org, which is not expected behavior IMO.

You only need the bucket name to do that. You should include a randomly generated prefix/suffix in bucket names to prevent against such enumeration attempts. Another good idea (as well as, not instead of) is to expose objects in buckets publicly with a non-default host name, such that the bucket name isn’t leaked at all.
Post reply on HN