Skip to main content

AWS Account ID

An AWS Account ID is a unique identifier assigned to each AWS account. It is used to identify resources and services associated with that account. While the Account ID itself does not grant access, its exposure can be a security concern as it can be used in conjunction with other information to target specific AWS accounts for unauthorized access or attacks. Knowing an AWS Account ID can aid attackers in crafting phishing attacks or attempting to exploit misconfigured services.

How Does It Look​

AWS Account IDs can appear in various contexts, such as:

  • Environment variables:

    export AWS_ACCOUNT_ID="123456789012"

  • Configuration files (JSON):

    {
      "account_id": "123456789012"
    }

  • Code snippets:

    aws_account_id = "123456789012"

  • Connection strings:

    arn:aws:iam::123456789012:role/MyRole

Severity​

  • 🟡 Medium

The exposure of an AWS Account ID is considered medium severity because, while it does not provide direct access to AWS resources, it can be used to facilitate targeted attacks. The blast radius is limited to the potential for social engineering and reconnaissance activities that could lead to further exploitation if combined with other compromised credentials.

What Can an Attacker Do?​

With immediate access to an AWS Account ID, an attacker can begin reconnaissance activities to gather more information about the account.

Key actions an attacker can perform:

  • Phishing attacks: Craft targeted phishing emails to AWS account users (if email addresses are known)
  • Social engineering: Attempt to deceive AWS support or account holders into revealing more sensitive information
  • Reconnaissance: Use the Account ID to identify public-facing resources or services (if misconfigured)

While the Account ID alone does not allow direct access, it can be a stepping stone for further attacks, especially if combined with other leaked credentials or information.

Real-World Impact​

The exposure of an AWS Account ID poses a business risk primarily through indirect means.

Potential consequences include:

  • Data Exposure: Increased risk of data exposure through targeted attacks (if other credentials are compromised)
  • Financial Loss: Potential for financial loss through fraudulent activities (if attackers gain further access)
  • Operational Disruption: Disruption of services through targeted attacks (if attackers exploit misconfigurations)
  • Reputational Damage: Damage to brand trust if customers are affected by phishing or other attacks

While the Account ID alone is not catastrophic, it can lead to cascading effects if attackers leverage it to gain further access or information.

Prerequisites for Exploitation​

  • Network access requirements: None, as the Account ID can be used from anywhere
  • Additional context needed: Knowledge of associated email addresses or other credentials
  • Any rate limits or restrictions they'd face: None specific to the Account ID

How to Verify If It's Active​

To verify if an AWS Account ID is active, you can use the AWS CLI to describe account settings:

aws organizations describe-account --account-id [ACCOUNT_ID]

Valid credential response: A successful response will return account details, confirming the Account ID is active.

Invalid/expired credential response: An error message indicating the account does not exist or is inaccessible.

Detection Patterns​

Common Variable Names:

  • AWS_ACCOUNT_ID
  • account_id
  • awsAccountId
  • AWSAccountID
  • accountId
  • aws_account_id

File Locations:

  • .env
  • config.json
  • settings.yaml
  • credentials
  • aws-config

Regex Pattern:

\d{12}

Remediation Steps​

  1. Revoke immediately - While you cannot revoke an Account ID, ensure no sensitive information is exposed alongside it.
  2. Audit access logs - Review AWS CloudTrail logs for any suspicious activities involving the Account ID.
  3. Assess blast radius - Identify all systems and services that may have been exposed to the Account ID.
  4. Rotate credential - Rotate any associated credentials that may have been exposed with the Account ID.
  5. Update dependent systems - Ensure all systems using the Account ID are secure and do not expose additional information.
  6. Harden access controls - Implement strict IAM policies and enable MFA for all users in the account.
  7. Implement secrets management - Use AWS Secrets Manager to manage sensitive information securely.
  8. Add detection controls - Set up monitoring and alerts for any unauthorized use of the Account ID.

Credential exposures often go undetected for extended periods, increasing the window for exploitation. As a long-term strategy, plan to establish an internal process or engage an external vendor for continuous external exposure monitoring. This helps identify leaked secrets across public repositories, paste sites, dark web forums, and other external sources before attackers can leverage them. Proactive detection and rapid response are essential to minimizing the impact of credential leaks.

References​