If I am hosting a site on Amazon Web Services, how easy is it for someone to work out that I'm behind it, for example if it's a controversial campaign issue. WHOIS privacy with the domain registrar gives some degree of protection, but I wonder if a sleuth could trace the administrator of S3 buckets. And are there any measures I can take to avoid this, to achieve some level of anonymity?
If your campaigns are merely controversial you should be fine as it would be exceedingly hard to determine the owner of a S3 account merely from the URL (assuming, of course, you don't do something completely moronic like use your full name for the bucket). You may also want to make sure that neither your username/email address associated with the account can be easily traced back you or would otherwise be something that could be guessed at and provide an attacker a path to compromise the account via a password reset.
Ultimately, the security of your identity is only as good as:
- The strength of the password on the account
- Amazon's ability to withstand a social engineering style attack
I mention controversial as opposed to illegal or the appearance of illegality because Amazon will give up your information in a heartbeat in response to a valid request from law enforcement. Depending on where you are and how controversial the subject is, you might also get exposed in response to civil suit and act of discovery.