4 ms·
AWS account ID is also safe to be public. That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites
by abadpoli 3y ago
AWS account ID is also safe to be public.
That said, one thing I could think of that this could be used for is correlation. If you’re running multiple S3 sites from the same AWS account, people would be able to see that they’re hosted by the same account. Whether or not this matters depends on your threat model.
- tracebit 3y agoExactly - this isn't going to open the door for someone but could add a ton of value to enumeration. As we are very canary focused, we also think it's interesting to consider the implications of the recent research from Truffle Security w.r.t canary tokens (https://trufflesecurity.com/blog/canaries https://trufflesecurity.com/blog/canaries).
- mschuster91 3y ago> AWS account ID is also safe to be public. Not necessarily. An AWS account ID + the knowledge of a role name that by mistake has the "allow role assumption" allowlist too wide (say "*") is now enough to take over the account. One might of course say "well then don't do that", but of course the more complex a system like IAM is the easier it is for unexperienced people to open the floodgates.
- anamexis 3y agoWell sure, but your account email isn't safe to be public if your password is "password".
- mschuster91 3y agoEmail providers have rate limits against specific user logins, IAM not.
- hiatus 3y agoHow do you know that?
- mschuster91 3y agoThat's easy to find out: change the API credentials of a user, but forget to update the service. Notice only a few days later that you forgot the change, but you also never got any notification "something" is going wrong. In contrast, every half-decent IdP will lock an account automatically after anything from 3-10 wrong attempts.
- dekhn 3y agoTurning what you said around, you're arguing you might want to keep an account ID secret for "security by obscurity" reasons. In my mind, even in a multi-layer security solution, even then the account ID should be considered as a public string whose knowledge (along with other bits like what misconfigurations it has) provides no additional vector of attack, because of defense in depth.
- sroussey 3y agoOh, there are other things... like a compromised chrome extension that only looks for your accountID being used and sends back credentials. Knowing an accountId tells you where to focus your efforts. You got through one hoop (of many).