Can we apply this same technique for other resource like ec2, lambda for ResourceAccount condition with *? This tool works using “aws sts” and –policy options, can we use other commands like aws ec2/lambda and –policy option with manual approach? and get the account ID?
Free Hands-On Lab Capture the Flag
Discover AWS Account ID via S3 Bucket
Learn how to enumerate AWS account IDs with very limited access to S3 buckets. This lab simulates compromised credentials and makes use of a clever automated tool to reduce guesses from 1 trillion possible combinations down to only 120.
Free hands-on lab
Launch this lab with a free account
Build practical, real-world skills in a cloud environment.
- Real cloud environments, not simulations
- One click to deploy, nothing to install
- We cover the cloud costs and risks so you can focus on learning
7 comments
Instructor
Hey, s3:ResourceAccount is an action that’s limited to S3 only, so you’d have to find a comparable action for other services in order to use this trick, and I’m not aware of any right now. There is another similar trick that was used to find Organization IDs with S3 VPC Endpoints though, and that’s published here.
ec2:ResourceAccount does exist, I don’t know why this similar technique can’t be used?
Instructor
Daniel Grzelak actually came up with another tool that explores using this for ResourceOrgID, etc… check it out: https://www.plerion.com/blog/conditional-love-for-aws-metadata-enumeration. Just learned about it! Looking at adding labs around this. Edit: created a lab for this that you can access here: Discover AWS Organization ID via S3 Bucket
Does it apply only to global namespace service resources ? and can other attributes like ResourceOrgID, ResourceOrgPath and ResourceTag/tag-key also be enumerated in the same way?
Very insightful, thank you for the lab!
Instructor
Glad you liked it!
Comments are currently read-only while we migrate to our new platform. In the meantime, ask questions in Discord.