The effective AWS principal that signs a request determines which resources can be touched, which account is billed, and which audit trail is written. Verification of that principal before destructive or cross-account operations is a foundational safety control. AWS provides two primary mechanisms for this verification. The AWS Security Token Service offers the get-caller-identity API which returns the Account, UserId, and Arn for the credentials that actually signed the request. Terraform exposes that same identity through the awscalleridentity data source, which surfaces the Account ID, ARN, and User ID for the credentials in use by Terraform during a plan or apply.
Both mechanisms are read-only, require no explicit allow for sts:GetCallerIdentity in the policy, and still require valid credentials capable of signing the request. The output is small but the operational consequences are large. A mismatch between expected and actual Account or Arn means the next deployment, data copy, or permission change will target the wrong environment.
Terraform awscalleridentity Data Source
The Terraform AWS provider exposes the caller identity as a data source with no arguments.
data "aws_caller_identity" "current" {}
The data source can be referenced in outputs to make the identity visible in Terraform state and CI logs.
output "account_id" {
value = "${data.aws_caller_identity.current.account_id}"
}
output "caller_arn" {
value = "${data.aws_caller_identity.current.arn}"
}
output "caller_user" {
value = "${data.aws_caller_identity.current.user_id}"
}
There are no arguments available for this data source. The provider resolves the identity from the credentials configured for the Terraform run. The impact is that the same Terraform configuration run with different credential sources, profiles, or environment variables will return different values without any change to the configuration itself. This makes the data source useful as a preflight assertion and as documentation of which principal the run is operating as.
The data source is licensed under MPL 2.0 by HashiCorp.
Attributes Returned by the Data Source
| Attribute | Description |
|---|---|
| account_id | The AWS Account ID number of the account that owns or contains the calling entity |
| arn | The AWS ARN associated with the calling entity |
| user_id | The unique identifier of the calling entity |
The accountid is a 12 digit number that identifies the AWS account. The arn identifies the principal type and name. The userid is the unique identifier of the calling entity. The exact format of user_id depends on principal type.
The real-world consequence is that outputs can be logged in CI pipelines, compared against an allow-list of approved accounts, and used to gate deployments. If the account_id does not match the intended target account, the pipeline can fail fast before any resources are modified.
AWS CLI sts get-caller-identity Operation
Checking the current caller identity in AWS CLI shows which AWS principal the current shell will use for the next signed request. The check belongs before deployments, cross-account scripts, policy changes, or any command where a wrong account or role would change live resources.
The STS get-caller-identity operation returns the UserId, Account, and Arn for the credentials that actually signed the request. AWS documents this call as not requiring an explicit allow on sts:GetCallerIdentity, but the CLI still needs valid credentials so it can sign the request at all.
The active identity can come from a named profile, exported credential variables, a credential_process helper, cached IAM Identity Center credentials, or an attached role on a container or instance. If the returned account or Arn is wrong, inspect the winning credential source before running the next command.
Response Fields
Regardless of the IAM identity used to authenticate the request, the API response always contains three fields:
- UserId - the unique identifier of the calling entity
- Account - the AWS Account ID number of the account that owns or contains the calling entity
- Arn - the Amazon Resource Name associated with the calling identity
The Account field is always a 12 digits number. Arn and UserId depend on the principal that initiated the request.
Constraints for Arn:
- min: 20
- max: 2048
- pattern: [\u0009\u000A\u000D\u0020-\u007E\u0085\u00A0-\uD7FF\uE000-\uFFFD\u10000-\u10FFFF]+
UserId -> string
The unique identifier of the calling entity. The exact value depends on the type of entity that is making the call. The values returned are those listed in the aws:userid column in the Principal table found on the Policy Variables reference page in the IAM User Guide.
Account -> string
The Amazon Web Services account ID number of the account that owns or contains the calling entity.
Arn -> string
The Amazon Web Services ARN associated with the calling entity.
Practical CLI Usage Patterns
Run the identity call from the same shell session that will run the real AWS command.
aws sts get-caller-identity --output json
Example output:
{
"UserId": "AIDASAMPLEUSERID",
"Account": "123456789012",
"Arn": "arn:aws:iam::123456789012:user/PlatformOperator"
}
The Account field is the target AWS account number, and the Arn shows what kind of principal the shell is using right now.
Return only the account number when you need one stable preflight value before a deployment, data copy, or other account-sensitive action.
aws sts get-caller-identity --query Account --output text
Example output:
123456789012
Use this account-only form when the only question is which AWS account the next command will touch.
Return only the Arn when you need to confirm the exact user, role, or role session name.
aws sts get-caller-identity --query Arn --output text
Example output:
arn:aws:iam::123456789012:user/PlatformOperator
arn:aws:iam::...:user/... means the shell is using an IAM user, while arn:aws:sts::...:assumed-role/.../... means the request is signed with temporary role credentials and the final segment is the current role session name.
Profile Explicit Checks
Check a named profile explicitly when the shell default is not trusted for the next request.
aws sts get-caller-identity --profile operations-admin --output json
Example output:
{
"UserId": "AROAEXAMPLEID:cli-session",
"Account": "210987654321",
"Arn": "arn:aws:sts::210987654321:assumed-role/OperationsAdmin/cli-session"
}
--profile selects the named profile for that one request and ignores any AWS_PROFILE selection, so the command does not depend on the shell's default profile.
Run an account-only or Arn-only check immediately before deployments, permission changes, and data-moving commands.
aws sts get-caller-identity --profile operations-admin --query Arn --output text
Example output:
arn:aws:sts::210987654321:assumed-role/OperationsAdmin/cli-session
Stop only when the returned account number and Arn match the environment you intend to touch.
If the profile uses IAM Identity Center or credential_process, refresh that login or helper first and then run aws sts get-caller-identity again.
Inspecting Resolved Configuration
Inspect the resolved configuration when the returned account or Arn is wrong.
aws configure list --profile operations-admin
Example output:
NAME : VALUE : TYPE : LOCATION
profile : operations-admin : manual : --profile
access_key : ****************ABCD : shared-credentials-file
secret_key : ****************WXYZ : shared-credentials-file
region : us-east-1 : config-file : ~/.aws/config
If the TYPE column shows env, exported variables are winning over file-backed settings.
Principal Categories and Field Formats
The AWS CLI command that you should issue to get this information is:
aws sts get-caller-identity
The User category simply corresponds to the IAM User principal.
The AssumedRole category covers more principals, but focus is on SAML federated user assumed via AssumeRoleWithSAML API, assumed role assumed via AssumeRole API, and role assigned to an Amazon EC2 instance.
For a complete overview of principals, refer to the documentation.
IAM User Example
{
"UserId": "AIDACKCEVSQ6C2EXAMPLE",
"Account": "123456789012",
"Arn": "arn:aws:iam::123456789012:user/JohnDoe"
}
The UserId corresponds to the unique ID of the IAM User.
The Arn field adheres to the following template: arn:aws:iam::
The caller is an IAM user example from AWS documentation:
aws sts get-caller-identity
Output:
{
"UserId": "AIDASAMPLEUSERID",
"Account": "123456789012",
"Arn": "arn:aws:iam::123456789012:user/DevAdmin"
}
Assumed Role Example
Assumed role output shows an ARN of form arn:aws:sts::account:assumed-role/role-name/session-name and a UserId that combines the role unique ID with the session name.
Example:
{
"UserId": "AROACKCEVSQ6C2EXAMPLE:[email protected]",
"Account": "123456789012",
"Arn": "arn:aws:sts::123456789012:assumed-role/..."
}
The UserId is the unique identifier of the calling entity. For assumed roles the UserId typically includes the role ID and session identifier.
Operational Safety Practices
The check belongs before deployments, cross-account scripts, policy changes, or any command where a wrong account or role would change live resources.
Steps to check the current caller identity in AWS CLI:
- Run the identity call from the same shell session that will run the real AWS command
- Return only the account number when you need one stable preflight value before a deployment, data copy, or other account-sensitive action
- Return only the Arn when you need to confirm the exact user, role, or role session name
- Check a named profile explicitly when the shell default is not trusted for the next request
- Inspect the resolved configuration when the returned account or Arn is wrong
- If the profile uses IAM Identity Center or credential_process, refresh that login or helper first and then run aws sts get-caller-identity again
The active identity can come from a named profile, exported credential variables, a credential_process helper, cached IAM Identity Center credentials, or an attached role on a container or instance.
Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal’s quoting rules. See Using quotation marks with strings in the AWS CLI User Guide.
See the Getting started guide in the AWS CLI User Guide for more information.
Conclusion
Caller identity verification is a small read-only call with large blast radius protection. The Terraform awscalleridentity data source surfaces accountid, arn, and userid for the credentials in use by Terraform. The AWS CLI sts get-caller-identity command returns UserId, Account, and Arn for the credentials that signed the request. Both return the same logical identity. The practical workflow is to query identity immediately before a sensitive operation, extract Account and Arn with --query and --output text, compare against an expected allow-list, and fail fast if mismatched. Inspecting aws configure list reveals which credential source is winning, and using --profile makes the check independent of shell environment variables. Because the call does not require an explicit sts:GetCallerIdentity allow but still requires valid credentials, it serves as an effective credential presence and scope test. Embedding these checks in CI pipelines, deployment scripts, and runbooks reduces the risk of operating on the wrong AWS account or with an unintended IAM principal.