# Level 2

In level 1, we were able to access the S3 bucket unauthenticated. However, for level 2, we will need to use our own AWS account. 

If you do not have an AWS account, you can create a free tier account [here.](https://aws.amazon.com/free/?all-free-tier.sort-by=item.additionalFields.SortRank\&all-free-tier.sort-order=asc\&awsf.Free%20Tier%20Types=*all\&awsf.Free%20Tier%20Categories=*all)

In the AWS console, navigate to IAM -> Security Credentials -> Access Keys

Create an access key. There will be an Access Key and a Secret Access Key that will be used to create a profile.

```
aws configure --profile <INSERT PROFILENAME>
```

<div align="left"><figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FTYx8hXTiBC3GBidOVk6U%2Fimage.png?alt=media&#x26;token=b6cc7715-bd12-4ad7-8dbf-d8f79fda0adc" alt=""><figcaption></figcaption></figure></div>

Just for fun, let’s try to list the contents of the bucket without using our credentials.&#x20;

We can see that we get the same error from level 1.

*Note: the URL not need “http” since we are working with an S3 bucket directly*

```
aws s3 ls s3://level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud/
```

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FjGl5oQF5RGH9nHymexCm%2Fimage.png?alt=media&#x26;token=90ae4625-b97e-487c-9be0-72961f2b7de9" alt=""><figcaption></figcaption></figure>

Now, let's use the profile that we created in the earlier step.

We can see that it allowed us to access the bucket contents using an authenticated profile.

```
aws s3 –profile flaws ls s3:// level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud/ 
```

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2FYgmWZfm99Xq87ov3iMpo%2Fimage.png?alt=media&#x26;token=8ade725d-a669-4f8e-aca4-4645311efc16" alt=""><figcaption></figcaption></figure>

We found the secret file for Level 2! After appending it to the URL (<http://level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud/secret-e4443fc.html>), we have successfully passed this level.

<figure><img src="https://450836410-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fgns9cN7UvH1POIBCfrRn%2Fuploads%2F0iTr7zLr0zB7r21fU6G4%2Fimage.png?alt=media&#x26;token=550f26a9-3c19-4b72-9390-50880013d616" alt=""><figcaption></figcaption></figure>

**Lessons Learned**

This S3 bucket had permissions set to "Any Authenticated AWS User". This misconfiguration violates the principle of least privilege by granting permissions to unnecessary identities.&#x20;

*Note from flaws.cloud: "This setting can no longer be set in the webconsole, but the SDK and third-party tools sometimes allow it."*