1

Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls.

Here are some example of ARNs:

<!-- Elastic Beanstalk application version -->
arn:aws:elasticbeanstalk:us-east-1:123456789012:environment/My App/MyEnvironment

<!-- IAM user name -->
arn:aws:iam::123456789012:user/David

<!-- Amazon RDS instance used for tagging -->
arn:aws:rds:eu-west-1:123456789012:db:mysql-db

<!-- Object in an Amazon S3 bucket -->
arn:aws:s3:::my_corporate_bucket/exampleobject.png

My question: what are the risks if these types of information are made available on a version control system such as Bitbucket or Github?

Improve this question

1 Answer 1

Reset to default
1

Probably none, unless you have insecure users.

I base this largely on the AWS Best Practices documentation, which (1) says nothing about protecting your account ID, and (2) encourages using roles to permit inter-account access. Since a role ARN contains the account ID, and they don't explicitly caution you to only share the ARN with a trusted party, one can assume that the account ID isn't very valuable.

That said, the account ID can be used to access a sign-in page that's specific to your account. If you have users with easily guessable names and passwords, it's possible that knowledge of your account ID can give attackers a way to exploit those users. I don't know how or if Amazon responds to brute force login attempts, so this may not be an issue either.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .