Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to find the AWS account ID of any S3 bucket

tracebit.com

Post reply on HN
Print view View original

201–210 of 227 posts

Re: How to find the AWS account ID of any S3 bucket

#201

Post by EE84M3i »

stingraycharles wrote: post #195
master_crab wrote: post #149

AWS account ID == Your IP address. It may be sensitive, but someone needs to know it to get s*$t done. Illustrative example: I had to deal with a third party that we needed to integrate with because of anti-money laundering procedures a year or two ago. I wanted my team to setup a privatelink with the organization because that's generally more secure than an open sftp port. The company refused citing security reasons…

AWS PrivateLink has another property that generally makes it undesirable for these types of integrations: communication is bidirectional, and IP subnets should not overlap. We (as a vendor ourselves) typically integrate as a VPC Endpoint Service, where communication is unidirectional and our service is exposed as a load balancer’s endpoint within the customer’s VPC.

I thought PrivateLink was branding for vpc interface endpoints? There's no ip subject restriction for that because it's basically a proxy. Are you thinking of vpc peering?

VPC endpoints seem preferable in this situation.

Re: How to find the AWS account ID of any S3 bucket

#202

Post by Dylan16807 »

abadpoli wrote: post #186
Dylan16807 wrote: post #94

Earlier quoted context omitted.

It's hubris to think any security measures are completely safe. Painting a target is a bad idea.

You’re still misunderstanding. I’m not saying you should go “paint a target” on yourself, I’m saying you should assume _someone else is_ going to paint a target on you, and defend yourself accordingly, rather than acting like the lack of a target protects you in any way.

> I’m not saying you should go “paint a target” on yourself,

Then I don't understand why you object so strongly to the tshirt example unless you're deliberately talking past the person that made it.

Re: How to find the AWS account ID of any S3 bucket

#203

Post by whs »

denysvitali wrote: post #155
NovemberWhiskey wrote: post #136

There seems to be a large discussion of whether account IDs are "secret" or "private" or "confidential" or whatever. From my point of view, that entirely misses the point. The problem here is that what's revealed here is the relationship between buckets and account IDs, which allows discovery of shared ownership of buckets (unless you use a micro-account approach). I probably don't care if you can discover that 23432…

Accounts on AWS are pretty cheap (free?) - why would you host everything on the same account?

In my company we use reseller billing as AWS do not have a local billing entity. The reseller owns the organization's root account and we do not have access to it. Every subaccount creation require a support email to the reseller.

Re: How to find the AWS account ID of any S3 bucket

#204

Post by baby_souffle »

coredog64 wrote: post #192
SamuelAdams wrote: post #142

Earlier quoted context omitted.

This is what I’m curious to learn. What can an attacker do with an AWS account ID? How is that any different from knowing someone’s email address?

Once I have an AWS account ID, my next trick is to grant cross-account bucket policies to discover role names in the account.

How does this work?

Re: How to find the AWS account ID of any S3 bucket

#205

Post by baby_souffle »

emilburzo wrote: post #33
nerdjon wrote: post #7

For sure an interesting find, but was kinda hoping based on the title that there was a more straightforward way to do this. I really wish that AWS had a simple way from an admin account to ask "where is X resource" within an organization to quickly tell me which account has a specific S3 bucket (and other things, but s3 buckets is the big one). Admittedly this is mostly an issue with legacy buckets that existed befor…

If you use AWS config setup for the organization (aggregator), you'll get a athena-sql-queryable inventory of all your resources from all organization accounts. So finding out which account owns a resource can be as simple as, roughly: select accountId where arn = "x"

You can also do this with steam pipe.

It might not scale well beyond tens of accounts though, depending in your query…

Re: How to find the AWS account ID of any S3 bucket

#207

Post by brickteacup »

sroussey wrote: post #56
efitz wrote: post #41

Earlier quoted context omitted.

That's the part that surprised me as well; it doesn't seem like a field that should be eligible for anything other than an exact match. I am unable to conceive of a use case for pattern matching account IDs.

Well, that assumes that the ID is cryptographically random. Perhaps that is a bad assumption.

it's irrelevant whether they're "cryptographically" random, all that matters is that account IDs are not controlled by the user and therefore have no logical relation to any access-control policies the user may wish to implement

Re: How to find the AWS account ID of any S3 bucket

#209

Post by leetcrew »

tempay wrote: post #68
dclowd9901 wrote: post #64

Earlier quoted context omitted.

Can you even block off IDs like this?

If you’re big enough to need it I’m sure it can be arranged.

aws support is not going to bend over backwards just to let you shoot yourself in the foot. it's more likely they grant an exception to one of the iam quotas.

Re: How to find the AWS account ID of any S3 bucket

#210

Post by darkwater »

zer00eyz wrote: post #179
darkwater wrote: post #160

Earlier quoted context omitted.

> Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1] We, the DevOps people, already knew about side channel attacks, Spectre and the likes, evaluated the performances hit for the fixes (or alleged fixes), patched our kernel boot params etc etc. We are curious people, just like many here.

Jesus, I have been in tech for 25 years and we're still throwing shit across this divide. Well we are, if nothing, consistent. The next nerd who pinches and inch of the coder/ops divide is going to make a billion.

¯\_(ツ)_/¯

Not GP, I tried to answer as friendly as possible. Their approach is even more weird given that Security goes really hand in hand with systems infrastructure In any small enough organization, security will be managed by devops/sre. If the org becomes large enough, it will start dedicating people to Security.

Post reply on HN