News for hackers. Stuff that matters.

A comment on It's now possible to find the AWS Account ID for any S3 Bucket (private too). Parent comment

Re:It's now possible to find the AWS Account ID for any S3 B... by efitz on Monday February 26, 2024 @04:10PM (#39516794)
AWS assigns these individually, and customers can’t influence the ID that they get. For access control purposes I see no valid use case for wildcards there.

Sharding on account ID might make sense if someone has a large number of them, but that would not necessitate wildcard matching.

[ Parent | on HN ]
Re:It's now possible to find the AWS Account ID for any S3 B... by viraptor on Monday February 26, 2024 @04:39PM (#39517033)
It sure could. If you're sharding by id and have some per-shard resources, they could definitely get permissions to only accounts 12345*. (I'm not saying it's a good idea, just that once you're in that situation, you would pattern match on partial IDs)
[ Parent | on HN ]
Re:It's now possible to find the AWS Account ID for any S3 B... by OJFord on Monday February 26, 2024 @09:49PM (#39519579)
But it could seem like a neat and obvious way to reduce policy size (which is limited) and make it arguably more readable, or at least the intention clearer. (I might assume `2847373847261`, `37385857721`, `5847262671`, ... is `*1` over our accounts, but I might be wrong, or I might forget (/not correctly automate) to add the new one.)
[ Parent | on HN ]