5 ms·
There seems to be a large discussion of whether account IDs are "secret" or "private" or "confidential" or whatever. From my point of view, that entirely misse
by NovemberWhiskey 3y ago
There seems to be a large discussion of whether account IDs are "secret" or "private" or "confidential" or whatever.
From my point of view, that entirely misses the point. The problem here is that what's revealed here is the relationship between buckets and account IDs, which allows discovery of shared ownership of buckets (unless you use a micro-account approach).
I probably don't care if you can discover that 2343242365 is the account number associated with "coolbuttplugs.com" but I probably do care if the same account hosts a bucket for "michaeljfoobar.name" and my buttplug thing is a sideshow from my white shoe law practice.
- denysvitali 3y agoAccounts on AWS are pretty cheap (free?) - why would you host everything on the same account?
- gaudystead 3y agoYou may be underestimating human laziness...
- whs 3y agoIn my company we use reseller billing as AWS do not have a local billing entity. The reseller owns the organization's root account and we do not have access to it. Every subaccount creation require a support email to the reseller.
- Garlef 3y agofree as in: AWS does not charge you not free as in: you have to manage it (for example give a CI role access via OIDC, create a role for you to assume to do stuff via the console, etc)
- NovemberWhiskey 3y agoMy favorite factoid about AWS accounts is that there's a global, hard rate limit for their deletion. It's actually a pain point for us.