How to find the AWS account ID of any S3 bucket (tracebit.com)

Article summary

The article describes a technique to find the AWS Account ID of any S3 bucket, both private and public, by utilizing a VPC Endpoint for S3 and a difference in behavior in CloudTrail when a request is denied by a VPC Endpoint policy. This method involves applying an IAM policy to the request and inferring whether the policy permitted or blocked the request. The technique can be automated and has been successfully used to find the Account ID of a bucket. The article also discusses the implications of considering AWS Account IDs as sensitive information.

Main themes

• AWS Account ID discovery
• S3 bucket security
• CloudTrail logging
• IAM policy management
• Security through obscurity

What commenters say

• AWS Account IDs should not be considered sensitive information because AWS does not treat them as such, and designing security models around their secrecy is flawed.
• Organizations may still want to keep their AWS Account IDs private as a matter of operational security, even if they are not technically secret.
• Relying on the secrecy of AWS Account IDs as a security control is misguided, as AWS does not guarantee their confidentiality.
• The ability to discover AWS Account IDs can be used to gather metadata about an organization's infrastructure and potentially exploit it.
• Security through obscurity can provide some secondary security benefits, but it should not be relied upon as a primary security measure.
• The disclosure of AWS Account IDs can have significant implications for espionage, alternative data collection, and competitive intelligence.