News for hackers. Stuff that matters.

A comment on Critical vulnerabilities in 6 AWS services disclosed at Black Hat USA.

Re:Critical vulnerabilities in 6 AWS services disclosed at B... by arianvanp on Thursday August 08, 2024 @09:24AM (#41191222)
Though Amazon has protection against confused deputies for Principals , even within an account (every principal has a unique ID, and is account scoped), it doesn't have the same for Resources.

And s3 buckets are not scoped to an account and their ARN is global and doesn't contain the account id.

For the same reason i advice anybody to always use random suffixes (easily done in Terraform with name_prefix) when generating bucket names.

[ Parent | on HN ]
Re:Critical vulnerabilities in 6 AWS services disclosed at B... by hypeatei on Thursday August 08, 2024 @09:29AM (#41191269)
> And s3 buckets are not scoped to an account

Never used AWS, but how does it handle auth for data plane operations then?

[ Parent | on HN ]
Re:Critical vulnerabilities in 6 AWS services disclosed at B... by noctarius on Thursday August 08, 2024 @10:24AM (#41191877)
It handles authentication on a request basis (which was its own issue just a little while ago): https://www.infoq.com/news/2024/05/aws-empty-s3-bucket-billi...
[ Parent | on HN ]