Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

121–130 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#121

Post by kube-system »

evandale wrote: post #114
kube-system wrote: post #103

Earlier quoted context omitted.

This is a false dichotomy. There is a deep chasm between "publish everything", and "this is a secret", called operational security. Any time a topic like this comes up, there are people on this forum that try to apply the "security by obscurity does not work" principle to every security topic under the sun, when in reality, that principle really only applies to the world of cryptography. In meat space, where humans o…

How is it possible for a user of AWS to keep the account ID secret if Amazon doesn't even consider it secret? If Amazon leaked your account ID they could point to their docs and say the account ID was never meant to be a secret, sensitive, or confidential.

You can walk over to the user's desk and ask them not to share it. Whether or not Amazon leaks it is unrelated to my employees' ability to follow instructions.

There is a lot of data that exists in a space somewhere between "100% secret" and "100% public". This is one of those situations, for many organizations.

Re: How to find the AWS account ID of any S3 bucket

#122

Post by pests »

belter wrote: post #91
jkaplowitz wrote: post #83

Earlier quoted context omitted.

OP's article said they consulted with Amazon's security team before publishing, so I imagine they know what's allowed in this case.

It says he consulted but does not say what was their answer. I can't imagine it was a thumbs up, probably an embarrassed silence?

Why all the doubt? "not sure" "can't imagine"

When the source says they already did their due diligence...

Re: How to find the AWS account ID of any S3 bucket

#123

Post by dpedu »

jameshart wrote: post #74
sroussey wrote: post #56

Earlier quoted context omitted.

Well, that assumes that the ID is cryptographically random. Perhaps that is a bad assumption.

My general assumption is not that they’re random, but at least that they’re not correlated ; in particular that Amazon is not in the habit of handing out, like, account IDs 676363687000 - 676363687999 to a single organization. Even if they did hand out a sequential batch of 1000 account IDs, it would be more likely to be 676363687541 - 676363688540 than a set with a single consistent prefix. Odds are that an account…

I once was involved in creating two (linked) amazon accounts at the "same" time, and ended up with account IDs of which the first 4 digits are identical.

Re: How to find the AWS account ID of any S3 bucket

#124

Post by rtkwe »

derefr wrote: post #75
x3n0ph3n3 wrote: post #69

Earlier quoted context omitted.

At that point you should be using AWS Organizations and OUs.

I think the GP is talking about granting access to a particular bucket to an unbounded number of customer AWS accounts — probably in requester-pays config. (Think: static data used by an Amazon Marketplace virtual appliance.)

Those wouldn't follow any particular partial pattern though would they?

Re: How to find the AWS account ID of any S3 bucket

#125

Post by thenickdude »

Related: AWS key IDs (not the secret key part) include your account ID within them, bitshifted by one position:

https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f...

These key IDs are included in the URL for pre-signed links to S3, so there's a good chance you've already been publishing your account ID.

Re: How to find the AWS account ID of any S3 bucket

#126

Post by paulddraper »

supriyo-biswas wrote: post #57
jameshart wrote: post #24

> The ability to apply a wildcard match on the s3:ResourceAccount condition key That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.

This is because, I assume, the AWS policy execution has a number of “operators” and “operands”, and in this case, you’re using the StringLike operand on the account ID string. Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1] now, although other types of side channels such as speculative execution side channels on CPUs (Meltdown, Spectre) already made waves at the ti…

> the AWS policy execution has a number of “operators” and “operands”

That is correct.

The IAM condition language is flexible and does not prevent you from doing strange things.

Re: How to find the AWS account ID of any S3 bucket

#127

Post by NovemberWhiskey »

twoodfin wrote: post #62
efitz wrote: post #41

Earlier quoted context omitted.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

But account IDs are assigned by Amazon and there's no structure within the namespace that's useful to you. If you mean all, you can wildcard * - but there doesn't seem to be any legitimate cases for "all account ids beginning with a 1".

Re: How to find the AWS account ID of any S3 bucket

#128

Post by NovemberWhiskey »

tempay wrote: post #68
dclowd9901 wrote: post #64

Earlier quoted context omitted.

Can you even block off IDs like this?

If you’re big enough to need it I’m sure it can be arranged.

If you're big enough to think you need it, you're also big enough to have people who can tell you it's a bad idea and there's a better tool for the job.

Re: How to find the AWS account ID of any S3 bucket

#129

Post by kube-system »

abadpoli wrote: post #21
electroly wrote: post #17

Earlier quoted context omitted.

While I agree, the way you wrote this might mislead people into thinking that you meant you can treat your account ID as non-secret because AWS does. That doesn't directly follow; the difference between AWS's point of view and your company's point of view means there are things you might care about that AWS does not. Rather, you need to follow AWS's lead and design your cloud deployment such that the account ID doesn…

No, this is wrong. The fact that AWS does not consider the ID a secret means that your company never should either. If your company “cares” about its ID being secret, then your company is designing its systems in an insecure way. The fact that AWS does not treat the ID as secret means you have no guarantees that anyone within AWS cannot see or find your ID. You also have no guarantee that AWS at some point won’t expo…

No, operational security might still a valid concern even where there are no issues with digital security.

You might have a 100% secure system, but you don't want your competitor to know exactly what you are doing. You might also not consider their knowledge of what you're doing to be a vulnerability, nor think that you should spend many resources on preventing them from knowing, you just don't want to make it easy for them.

Cryptography is very black-and-white. Business operational intelligence is not.

Re: How to find the AWS account ID of any S3 bucket

#130

Post by orf »

Interesting post. I wonder if you can further combine it by using a PrincipalTag in some way? You can assume a number of roles with different tag values, and these can be interpolated into the condition. This lets you do things without a huge statement?
Post reply on HN