Well, it's just an AWS Account ID
mail.cloudsecurity.club
Well, it's just an AWS Account ID
1–10 of 36 posts
Re: Well, it's just an AWS Account ID
#2Nice article. For those interested here is a project listing companies who's AWS account IDs are known (generally because the IDs have been publicly disclosed by the company itself for product integration purposes)
Re: Well, it's just an AWS Account ID
#3This seems wrong. Surely you can’t “Enumerate IAM Entities” with just the aAccount ID?
So if a company has a user for every dev with username first.last, you could list all devs just by knowing the Account ID?
Maybe the author misunderstood what “enumerate” means and meant to say that you can check if a given IAM entity exists under the account? Enumeration and bruteforce are very different things.
Re: Well, it's just an AWS Account ID
#4So many words and FUD...with the bottom line being...
> Here's my take: The Account ID is useless and not a direct weakness.
Re: Well, it's just an AWS Account ID
#5This seems wrong. Surely you can’t “Enumerate IAM Entities” with just the aAccount ID? So if a company has a user for every dev with username first.last, you could list all devs just by knowing the Account ID? Maybe the author misunderstood what “enumerate” means and meant to say that you can check if a given IAM entity exists under the account? Enumeration and bruteforce are very different things.
You're correct, it's not enumeration, but it's easier than pure brute force. As the article itself suggests, if the company does use a predictable user name format (and most do), it's pretty trivial to look up their employees on LinkedIn, create a list of likely usernames, and then check if they exist.
Re: Well, it's just an AWS Account ID
#6This seems wrong. Surely you can’t “Enumerate IAM Entities” with just the aAccount ID? So if a company has a user for every dev with username first.last, you could list all devs just by knowing the Account ID? Maybe the author misunderstood what “enumerate” means and meant to say that you can check if a given IAM entity exists under the account? Enumeration and bruteforce are very different things.
Yes, you're right. Reading my statement in hindsight shows thats not correct. My intention was to convey that you can check for the existence of common IAM users and roles in the accounts (and even existence of company specific entities like users with first.last pattern, product names, etc)
I've slightly updated the point a bit.
Re: Well, it's just an AWS Account ID
#7So many words and FUD...with the bottom line being... > Here's my take: The Account ID is useless and not a direct weakness.
Agree, obscurity is mostly not good to rely on, it allows you to congratulate yourself about defense in depth and what not but it’s a bit security theatre
Re: Well, it's just an AWS Account ID
#8Relevant talk how you can discover the AWS Account ID of any S3 bucket:
https://pretalx.com/fwd-cloudsec-2024/talk/9FRYE9/
Re: Well, it's just an AWS Account ID
#9[flagged]
Re: Well, it's just an AWS Account ID
#10So many words and FUD...with the bottom line being... > Here's my take: The Account ID is useless and not a direct weakness.
I see a tiny scrollbar on an article starting with "Let’s dive into a highly debated topic"...
I figured it must be AI-generated slop, and closed the window.