CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
Abhishek Soni
Abhishek Soni

Reputation: 319

Why does S3 bucket ARN not contain AWS account number?

Unlike other AWS services, s3 resources, ARN does not contain AWS account number.
Few sample ARNs are:

On the other hand s3 bucket ARN looks like:

Upvotes: 16

Views: 17426

Answers (3)

Lorenzo
Lorenzo

Reputation: 119

The question is "Why does S3 bucket ARN not contain AWS account number?" and the answer to that is because S3 was the first AWS service to be launched and many things have changed since then. S3 hasn't managed yet to implement the ARN in the bucket name. We don't know why that is. It could be that it's technically challenging or that it's just not being prioritized by the service team.

One way to validate that the bucket objects are being uploaded to belongs to you to avoid accidental data leak to other people's buckets is to use the recently released bucket owner condition:

https://aws.amazon.com/about-aws/whats-new/2020/09/amazon-s3-bucket-owner-condition-helps-validate-correct-bucket-ownership https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-owner-condition.html

Another way (where supported) is to use S3 Access Points: https://aws.amazon.com/s3/features/access-points/

Upvotes: 6

Lorenzo
Lorenzo

Reputation: 119

The problem with this, however, is that it is not possible to write a policy that restricts actions only on a bucket in my account. The risk being that some user in my account may leak data out by pushing data to another account’s bucket.

Upvotes: 3

RobertoNovelo
RobertoNovelo

Reputation: 3819

S3 Bucket ARNs do not require an account number or region since bucket names are unique across all accounts/regions.

Upvotes: 30

Related Questions