4 ms·
AWS account IDs aren’t secret, but the identity of who owns particular S3 bucket names is meant to be. If you get an email apparently from AWS that correctly n
by jameshart 3y ago
AWS account IDs aren’t secret, but the identity of who owns particular S3 bucket names is meant to be.
If you get an email apparently from AWS that correctly names an S3 bucket and the associated account ID, are you more likely to take it seriously than an email that just names a bucket?
- afavour 3y agoNot to mention it also means you can establish relationships between buckets by finding common ownership. No, the account ID isn’t secret but I don’t think we should be dismissive of this new information either. It’s still important metadata to factor into decision making.
- btown 3y agoMore generally, this opens up all sorts of threat models for espionage and alternative data. A private bucket called project-foobar-logs-staging might have its existence known in an index but never have been known to be associated with Baz Corp's publicly-known image buckets - but with this disclosure, a database will become available making that association possible. And it will be possible to monitor if and when project-foobar-logs-prod gets provisioned. Not to mention that state-level actors would love to see an enumerable list of projects their rivals are working on, and if any of them happen to have been secured only by obscurity in the past. Edge cases, to be sure, but certainly nontrivial.