This talk presents a new technique for discovering the AWS Account ID of private S3 buckets where previously this was only possible for public buckets. We’ll break down this intricate technique, invite participants to consider where else they could apply a similar approach and explore the implications of S3 bucket’s Account IDs now becoming public. We’ll use the interaction of IAM condition keys, VPC Endpoint policies and CloudTrail to uncover the account ID of a bucket to which we don’t have access.