221–227 of 227 posts
aws s3 bucket needs to match the domain for website hosting. let's say if apple uses s3, they need to create bucket name "apple.com", and then we can find what aws account which apple is using.
Not exactly - they Can do that, but they don't need to match - using cloudfront in front of your s3 website and then the site can be served from any bucket or folder within a bucket. I have dozens of s3 static websites served from a single s3 bucket, all with unique top-level domains, each in its own folder within that single bucket - much easier this way. Given anyone can create a bucket with any name (if its not al…
aws s3 bucket needs to match the domain for website hosting. let's say if apple uses s3, they need to create bucket name "apple.com", and then we can find what aws account which apple is using.
That is not how s3 buckets work.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/websit...
Earlier quoted context omitted.
Doubt they use their real information on their AWS accounts.
Just need enough information to send to either Amazon or the FBI.
They are visible when ever you share something with another AWS account, they're in the ARN. For example, the 12 digit account IDs of all a vendors that vend AMIs, assume roles on AWS accounts (think datadog, for logging / metrics) or otherwise provide services have AWS Account IDs that are well known and easily discoverable. This s3 example is just sort of interesting since its one of the handful of AWS services that don't use account IDs in ARNs.
AWS account ids are not secrets and treating them as secrets or giving the impression that they are anything other than public data is a distraction from real security concerns.
Earlier quoted context omitted.
It says he consulted but does not say what was their answer. I can't imagine it was a thumbs up, probably an embarrassed silence?
They can fix the bug if they don't like it.