3 ms·

I take it advertising your account id isn't a security risk?

• aduwah 7mo ago
  It is not hygienic, but with only the account-id you are fine. In the IAM rules the attacker can always just use a * on their end, so it does not make a difference. You have to be conscious to set proper rules for your (owner) end tho.
• Cthulhu_ 7mo ago
  Armchair opinion, but shouldn't be too bad - it's identification, not authentication, just like your e-mail address is. But probably best to not advertise it too much.
• deleted 7mo ago
  [deleted]
• otterley 7mo ago
  AWS does not consider it one. “While account IDs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information.” https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html https://docs.aws.amazon.com/accounts/latest/reference/manage...
• thenickdude 7mo ago
  If you ever produce and share a signed link for e.g. S3, this link contains your access key ID in it. Turns out you can just slice and decode your Account ID out of that access key, it's in there in base32: https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489 https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f...