Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

141–150 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#141

Post by [deleted] »

abadpoli wrote: post #21
electroly wrote: post #17

Earlier quoted context omitted.

While I agree, the way you wrote this might mislead people into thinking that you meant you can treat your account ID as non-secret because AWS does. That doesn't directly follow; the difference between AWS's point of view and your company's point of view means there are things you might care about that AWS does not. Rather, you need to follow AWS's lead and design your cloud deployment such that the account ID doesn…

No, this is wrong. The fact that AWS does not consider the ID a secret means that your company never should either. If your company “cares” about its ID being secret, then your company is designing its systems in an insecure way. The fact that AWS does not treat the ID as secret means you have no guarantees that anyone within AWS cannot see or find your ID. You also have no guarantee that AWS at some point won’t expo…

[deleted]

Re: How to find the AWS account ID of any S3 bucket

#142

Post by SamuelAdams »

sylens wrote: post #39

While I wouldn't publicly hand out my account IDs as a general practice, I think you have to expect that some of them will be disclosed at some point. As more third party vendors and SaaS platforms move away from IAM users and access keys to using role assumption as the preferred method of integration (as they should!), the account ID of at least the account you use as their integration point is now known by another…

This is what I’m curious to learn. What can an attacker do with an AWS account ID? How is that any different from knowing someone’s email address?

Re: How to find the AWS account ID of any S3 bucket

#144

Post by chrisjj »

cj wrote: post #70

> While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information. https://docs.aws.amazon.com/accounts/latest/reference/manage...

> they are not considered secret, sensitive, or confidential information

... by us (it should say).

Users may consider it differently.

Re: How to find the AWS account ID of any S3 bucket

#145

Post by remus »

NovemberWhiskey wrote: post #127
twoodfin wrote: post #62

Earlier quoted context omitted.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

But account IDs are assigned by Amazon and there's no structure within the namespace that's useful to you. If you mean all, you can wildcard * - but there doesn't seem to be any legitimate cases for "all account ids beginning with a 1".

Presumably the permissions language is broadly defined and has something like

    filter = property, operand, value
with few constraints on which operands can be used in which situations, to keep parsing the language simple (parsers being notoriously prone to vulnerabilities after all). In retrospect perhaps that isn't a good trade-off, but it would be tricky to tighten things up now without breaking lots of existing users.

Re: How to find the AWS account ID of any S3 bucket

#147

Post by fnordpiglet »

sroussey wrote: post #58
fnordpiglet wrote: post #55

Earlier quoted context omitted.

They’re not a secret, in fact it’s what you use to share the identity of one account with another, possibly third party’s account. It’s a secret in the way your personal email address is. You may not advertise it on 4chan, but you definitely share it to limited audiences. Once you’ve shared it it’s no longer an actual secret. Indeed, as has been noted, aws itself doesn’t treat your account id as a secret and freely s…

Yes, but I do use random email addresses (that look like passwords) to stop correlation, concerted credential stuffing (that might lock me out for a time), etc. And if it pops up in a compromised server no one will know that email address is mine.

And aws also offers ideas like external IDs and similar concepts to do something like this.

But you might notice that even aws services advertise their own account ids. They’re not secrets and treating them as such doesn’t help you improve security.

Re: How to find the AWS account ID of any S3 bucket

#148

Post by viraptor »

efitz wrote: post #137
twoodfin wrote: post #62

Earlier quoted context omitted.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

AWS assigns these individually, and customers can’t influence the ID that they get. For access control purposes I see no valid use case for wildcards there. Sharding on account ID might make sense if someone has a large number of them, but that would not necessitate wildcard matching.

It sure could. If you're sharding by id and have some per-shard resources, they could definitely get permissions to only accounts 12345*. (I'm not saying it's a good idea, just that once you're in that situation, you would pattern match on partial IDs)

Re: How to find the AWS account ID of any S3 bucket

#149

Post by master_crab »

AWS account ID == Your IP address. It may be sensitive, but someone needs to know it to get s*$t done.

Illustrative example: I had to deal with a third party that we needed to integrate with because of anti-money laundering procedures a year or two ago. I wanted my team to setup a privatelink with the organization because that's generally more secure than an open sftp port. The company refused citing security reasons to hide their Account Id (it's needed for the role ARN used for reciprocal permissions to PV endpoints). So what did we do?

We ended up whitelisting a range of public IPs they use for inbound port 22...

Moral of the story: you may think you are a genius for obfuscating your IDs, but you can't really run a business unless people have an address back to you

Re: How to find the AWS account ID of any S3 bucket

#150

Post by sylens »

SamuelAdams wrote: post #142
sylens wrote: post #39

While I wouldn't publicly hand out my account IDs as a general practice, I think you have to expect that some of them will be disclosed at some point. As more third party vendors and SaaS platforms move away from IAM users and access keys to using role assumption as the preferred method of integration (as they should!), the account ID of at least the account you use as their integration point is now known by another…

This is what I’m curious to learn. What can an attacker do with an AWS account ID? How is that any different from knowing someone’s email address?

If the account and its resources are properly configured - not much.

But that can be easier said than done for many organizations, especially when you have lots of different teams configuring their own environments.

Post reply on HN