kreuzwerker / awsu

Enhanced account switching for AWS, supports Yubikey as MFA source

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Hardcoded account ID in source code?

forsberg opened this issue · comments

Looking at the source code, it looks like there's a hardcoded Amazon account ID (015428540659) as client_id in one of the generated URLs for the awsu console command.

Is is supposed to be like that, or is it an unfortunate copy-paste accident?

url := fmt.Sprintf("https://signin.aws.amazon.com/oauth?redirect_uri=https://%s.console.aws.amazon.com/console/home?region=%s&client_id=arn:aws:iam::015428540659:user/homepage&response_type=code&iam_user=true&account=%s",

That's a magic AWS account ID associated with the AWS signin page. You can see it by viewing the source on https://aws.amazon.com/marketplace/management/signin

Thanks for the keen eye @forsberg and thanks @craighurley for the explanation. We'll add a comment linking to the issue next release.