Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

191–200 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#191

Post by junon »

kube-system wrote: post #103
junon wrote: post #48

Earlier quoted context omitted.

If you place any sort of security assumptions on AWS account IDs into your threat model, you're effectively directly introducing a security vulnerability. If you're not then why include it into your security threat model to begin with? I believe that is their point. Since AWS does not, and has never, treated that information as secret, then there is absolutely no reason to consider it sensitive because there is no se…

This is a false dichotomy. There is a deep chasm between "publish everything", and "this is a secret", called operational security. Any time a topic like this comes up, there are people on this forum that try to apply the "security by obscurity does not work" principle to every security topic under the sun, when in reality, that principle really only applies to the world of cryptography. In meat space, where humans o…

And what OpSec benefit is there?

Re: How to find the AWS account ID of any S3 bucket

#192

Post by coredog64 »

SamuelAdams wrote: post #142
sylens wrote: post #39

While I wouldn't publicly hand out my account IDs as a general practice, I think you have to expect that some of them will be disclosed at some point. As more third party vendors and SaaS platforms move away from IAM users and access keys to using role assumption as the preferred method of integration (as they should!), the account ID of at least the account you use as their integration point is now known by another…

This is what I’m curious to learn. What can an attacker do with an AWS account ID? How is that any different from knowing someone’s email address?

Once I have an AWS account ID, my next trick is to grant cross-account bucket policies to discover role names in the account.

Re: How to find the AWS account ID of any S3 bucket

#193

Post by OJFord »

efitz wrote: post #137
twoodfin wrote: post #62

Earlier quoted context omitted.

If for some reason you’re dealing with thousands of accounts that are architecturally indistinguishable, bucketing them by ID prefix isn’t a particularly wild thing to want to do.

AWS assigns these individually, and customers can’t influence the ID that they get. For access control purposes I see no valid use case for wildcards there. Sharding on account ID might make sense if someone has a large number of them, but that would not necessitate wildcard matching.

But it could seem like a neat and obvious way to reduce policy size (which is limited) and make it arguably more readable, or at least the intention clearer. (I might assume `2847373847261`, `37385857721`, `5847262671`, ... is `*1` over our accounts, but I might be wrong, or I might forget (/not correctly automate) to add the new one.)

Re: How to find the AWS account ID of any S3 bucket

#194

Post by kube-system »

abadpoli wrote: post #187
kube-system wrote: post #121

Earlier quoted context omitted.

You can walk over to the user's desk and ask them not to share it. Whether or not Amazon leaks it is unrelated to my employees' ability to follow instructions. There is a lot of data that exists in a space somewhere between "100% secret" and "100% public". This is one of those situations, for many organizations.

You’re wasting your employees time by asking them to keep it secret, when you gain absolutely no benefit from keeping it secret (and in fact are introducing an easy failure point by pretending it’s secret) and you have no guarantees that others are keeping it secret. > This is one of those situations, for many organizations. And those organizations are wrong.

Many organizations just have a blanket policy that you shouldn't be exposing data about an organization's infrastructure unless you need to do it. This is a good policy.

> by pretending it’s secret

No, nobody needs to pretend it is secret. You're missing my above point. There is not a dichotomy between secret and public. It is possible for something to be neither secret nor public.

Re: How to find the AWS account ID of any S3 bucket

#195

Post by stingraycharles »

master_crab wrote: post #149

AWS account ID == Your IP address. It may be sensitive, but someone needs to know it to get s*$t done. Illustrative example: I had to deal with a third party that we needed to integrate with because of anti-money laundering procedures a year or two ago. I wanted my team to setup a privatelink with the organization because that's generally more secure than an open sftp port. The company refused citing security reasons…

AWS PrivateLink has another property that generally makes it undesirable for these types of integrations: communication is bidirectional, and IP subnets should not overlap.

We (as a vendor ourselves) typically integrate as a VPC Endpoint Service, where communication is unidirectional and our service is exposed as a load balancer’s endpoint within the customer’s VPC.

Re: How to find the AWS account ID of any S3 bucket

#196

Post by kube-system »

junon wrote: post #191
kube-system wrote: post #103

Earlier quoted context omitted.

This is a false dichotomy. There is a deep chasm between "publish everything", and "this is a secret", called operational security. Any time a topic like this comes up, there are people on this forum that try to apply the "security by obscurity does not work" principle to every security topic under the sun, when in reality, that principle really only applies to the world of cryptography. In meat space, where humans o…

And what OpSec benefit is there?

Well, as a very relevant example, if you tell others what your AWS account ID is, they can figure out if you own any particular bucket. The metadata association between the content of that bucket and the owner might give away information that the contents of the bucket doesn't indicate on its own. It also might not be a technical vulnerability, but that association itself could imply some proprietary business information. Or it could give clues to any would-be attacker as to other resources to target. In business, there are lots of types of information that are not secret, but are also not public.

Re: How to find the AWS account ID of any S3 bucket

#197

Post by staplers »

zer00eyz wrote: post #179
darkwater wrote: post #160

Earlier quoted context omitted.

> Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1] We, the DevOps people, already knew about side channel attacks, Spectre and the likes, evaluated the performances hit for the fixes (or alleged fixes), patched our kernel boot params etc etc. We are curious people, just like many here.

Jesus, I have been in tech for 25 years and we're still throwing shit across this divide. Well we are, if nothing, consistent. The next nerd who pinches and inch of the coder/ops divide is going to make a billion.

Figma did this for design-dev and is worth about $40 billion.

It's amazing how anything got made considering how disjointed processes used to be.

Re: How to find the AWS account ID of any S3 bucket

#198

Post by lobsterthief »

creatonez wrote: post #131
jameshart wrote: post #24

> The ability to apply a wildcard match on the s3:ResourceAccount condition key That’s the crazy part. No good can ever come from this - there is no legitimate reason why you would grant or deny permission based on a partial account id match.

> there is no legitimate reason why you would grant or deny permission based on a partial account id match. You're not a fan of my AWS lottery idea where accounts ending in 666 get access to a free bitcoin miner??

I love the idea, but maybe we can pair it with my ICO idea of flipping a virtual stack of Pogs to unlock new units of currency that can be mined.

Re: How to find the AWS account ID of any S3 bucket

#199

Post by msie »

staplers wrote: post #197
zer00eyz wrote: post #179

Earlier quoted context omitted.

Jesus, I have been in tech for 25 years and we're still throwing shit across this divide. Well we are, if nothing, consistent. The next nerd who pinches and inch of the coder/ops divide is going to make a billion.

Figma did this for design-dev and is worth about $40 billion. It's amazing how anything got made considering how disjointed processes used to be.

Only worth about 10 billion. But still a lot!

Re: How to find the AWS account ID of any S3 bucket

#200

Post by 8organicbits »

dotancohen wrote: post #188
victorbjorklund wrote: post #71

Earlier quoted context omitted.

Doubt they use their real information on their AWS accounts.

Just need enough information to send to either Amazon or the FBI.

Shouldn't the bucket name / URL be enough?
Post reply on HN