3 ms·
I'm not understanding how "breakingFormation" provides access to other account data. They tried it on their own account and were denied. AWS uses these crypto
by onphonenow 5y ago
I'm not understanding how "breakingFormation" provides access to other account data.
They tried it on their own account and were denied. AWS uses these crypto tokens, so it's request -> IAM signed -> Cloudformation -> S3.
Is there maybe a gap where if someone is using S3 a lot, the forward session token thing can be worked around (ie, the Cloudformation service WOULD still have a valid token for another accounts S3 bucket)?
The easy thing here is set up 2 accounts, and actually test it. Curious why they didn't do that.
- aws-dev 5y agoThey don't provide access to other account data. These credentials are scoped down to a specific purpose. Colm mentions this here: https://twitter.com/colmmacc/status/1481682859324760070 https://twitter.com/colmmacc/status/1481682859324760070
- onphonenow 5y agoI do wonder if there could be a gap where the credentials are scoped down, but the service does have broader access because other users have made recent requests if the metric is just did a user request something from S3 (most do). Or is the scope down to request for X object by Y customer, which is then signed / token attached by IAM, valid for a little bit. That would reduce radius a lot. Kind of bummed they hyped this one because the Glue one is more interesting to me an a more credible route I thought.