Documentation
¶
Overview ¶
Package awskey decodes an AWS access key ID (AKIA…/ASIA…/AROA… — the 20-char unique IDs AWS issues for keys, roles, users, and policies) into the **AWS account ID** bit-packed inside it and the **credential type**. A leaked AWS key is prime cloud-pentest / IR loot, and recovering the owning account ID + the key type **offline, without calling AWS** (no `sts get-access-key-info`, no log entry, no detection) is a standard recon technique. Pure offline transform; no network or device.
Wrap-vs-native judgement ¶
Native. The account ID is encoded in the key ID: strip the 4-char type prefix, base32-decode the rest, read the first 6 bytes big-endian, mask with 0x7FFFFFFFFF80 and right-shift 7. A base32 decode + a shift, stdlib only — nothing to wrap. The bit layout was reverse-engineered by Aidan Steele / WithSecure / Truffle Security and is implemented identically across the public tools (e.g. github.com/psanford/aws-account-id-from-key).
Verifiable / no confidently-wrong output ¶
Anchored to two published vectors — ASIAY34FZKBOKMUTVV7A → 609629065308 and ASIAQNZGKIQY56JQ7WML → 029608264753 (the latter is the psanford reference implementation's own test vector). To avoid emitting a bogus account ID for an arbitrary base32 string, only the recognised AWS unique-ID prefixes are accepted; an unknown prefix, a wrong length, or a non-base32 body is rejected.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
// KeyID is the input (upper-cased).
KeyID string `json:"key_id"`
// KeyType is the 4-char prefix (AKIA, ASIA, AROA, …).
KeyType string `json:"key_type"`
// Description is the human meaning of the prefix.
Description string `json:"description"`
// AccountID is the 12-digit AWS account ID embedded in the key.
AccountID string `json:"account_id"`
// Usable is true for the prefixes that are actual access keys you can
// authenticate with (AKIA long-term, ASIA temporary); the others are
// resource unique IDs that merely leak the account.
Usable bool `json:"usable_credential"`
}
Result is the decoded view of an AWS access key ID.
Source Files