3 ms·
Well this was an unwelcome attack vector, since I wrangle a fair few S3 buckets. I hastily threw together an S3 bucket name generator in Bash under Linux [1] to
by yenant 2y ago
Well this was an unwelcome attack vector, since I wrangle a fair few S3 buckets. I hastily threw together an S3 bucket name generator in Bash under Linux [1] to create names that follow the AWS rules to start my migration to my new S3 bucket names, and welcome any help to ensure it creates names that are strongly resistant to this attack, and follow various S3-service-like vendor rules, so I can do what I can until AWS and others come out with a stronger defense.
[1] https://github.com/automaticit-anthonyyen1/s3-bucket-name-generator https://github.com/automaticit-anthonyyen1/s3-bucket-name-ge...
- busymom0 2y agoReminder that if you are using pre-signed urls, then that url also exposes the bucket name. So, using hard to guess bucket names isn't a solution for many people. And if you are using static websites, then amazon's own docs require you to use the website name as bucket name.