Assuming we have the account ID we found through xyz mechanisms. Here, through user ID bruteforce by public S3 bucket URL.
First, it would be good to know the AWS region that the S3 bucket was created in, as public snapshots are available to all users in the same region that the EBS or RDS snapshot was created in. It's likely that if the S3 bucket was created in a specific region, that other resources will be available there too!
To find the S3 bucket region we can use another trick, this time with cURL.
curl -I https://mega-big-tech.s3.amazonaws.com
us-east-1 is the bucker region in the header as we can see
From the account ID and region we can now go to the amazon console in personal account and go to EC2 and look for public snapshots.
