C-AWS-ACCT-ENUMReconnaissance

AWS Account ID Enumeration

Match a public ARN, S3 bucket, or KMS key alias back to its 12-digit account ID — required for cross-account role assumption.

§ Where this technique fits

C-AWS-ACCT-ENUM is catalogued under the Reconnaissance tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

§ Dossiers chaining this technique

GitHub OIDC trust over-broad → AWS admin
An IAM role trusts GitHub Actions OIDC with a wildcard 'repo:*' subject. Any attacker GitHub repo can assume the role and run with its privileges.
step 1 / 6

§ What commonly comes next

01
Cloud OIDC Trust Misconfiguration
C-OIDC-TRUST-MISCONF · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

GitHub OIDC trust over-broad → AWS admin

§ What commonly comes next