Usually, the more information an attacker has about you, the higher the chances of coming up with a successful attack vector.

„So let’s give them an API to make their job easier!”

Maybe information that's not secret or confidential, but could still be used to exploit you, should be called something like "sensitive" information.

There is plenty of information that you wouldn't necessarily want to publish, but wouldn't be the end of the world if it were leaked either.

A hacker can enumerate the resources of and access to an account by using its account ID. Many AWS customers incorrectly configure resources such that any other AWS customer can access things in their AWS account; for example, some 3rd party providers tell customers to configure access for the 3rd party, that can lead to wide-open access for anyone who knows the customer's account ID. If the cloud admins don't know what they're doing it can be very easy to screw up and not realize it.

It's sort of like giving someone your IP address. By itself it's not enough to hack someone. But if your host is insecure, it sure makes it easier knowing exactly where to attack.

There are levels of data classification, and different regulations and policies apply to each level and geo. They are probably disavowing themselves of any liability.

https://docs.aws.amazon.com/whitepapers/latest/data-classifi...

This is a good question for any provider like AWS--what kinds of information do I leak with seemlingly mundane choices like bucket names.

The other attack vector is from insiders. Many organizations "shield" identifiable information behind UUIDs or some other scheme. In the event of a breach, the UUID might mean nothing to most (it's not foolproof, though), but opens more doors for an insider.

My personal phone number is not exactly secret or confidential, but I only share it carefully.