Home > Hands-On Labs > Lab
Comments
What's a Hands-On Lab?
1-Click Deployments
AWS lab environments at the click of a button. Skip the hassle of creating or managing practice accounts and dive straight into using real resources.
Practical Learning
Learn cloud security with real AWS resources and real-world scenarios, not just theory.
Risk Free
No surprise bills when you forget to delete learning resources, and keep vulnerable training environments safely isolated from your corporate and production resources.
Responses
Can we apply this same technique for other resource like ec2, lambda for ResourceAccount condition with *? This tool works using “aws sts” and –policy options, can we use other commands like aws ec2/lambda and –policy option with manual approach? and get the account ID?
Hey, s3:ResourceAccount is an action that’s limited to S3 only, so you’d have to find a comparable action for other services in order to use this trick, and I’m not aware of any right now. There is another similar trick that was used to find Organization IDs with S3 VPC Endpoints though, and that’s published here.
ec2:ResourceAccount does exist, I don’t know why this similar technique can’t be used?
Daniel Grzelak actually came up with another tool that explores using this for ResourceOrgID, etc… check it out: https://www.plerion.com/blog/conditional-love-for-aws-metadata-enumeration. Just learned about it! Looking at adding labs around this. Edit: created a lab for this that you can access here: Discover AWS Organization ID via S3 Bucket
Does it apply only to global namespace service resources ? and can other attributes like ResourceOrgID, ResourceOrgPath and ResourceTag/tag-key also be enumerated in the same way?
Very insightful, thank you for the lab!
Glad you liked it!