The awscalleridentity data source provides a way to query the effective AWS identity under which Terraform is operating. It returns the account ID, ARN, and user identifier that are used for the current provider configuration. Using this data source allows configurations to reference the calling account dynamically instead of hard coding values.
Overview of the Data Source
The awscalleridentity data source is used to obtain access to the effective Account ID, User ID, and ARN in which Terraform is authorized.
- The AWS account_id is a unique identifier for your AWS account.
- In Terraform, you can dynamically retrieve this value using the awscalleridentity data source.
- To use the AWS accountid variable in Terraform, use the awscaller_identity data source. This allows you to dynamically retrieve the account ID for use in your configurations.
The data source requires no arguments. The declaration is minimal:
hcl
data "aws_caller_identity" "current" { }
Once declared, the attributes can be referenced in outputs or other resources.
Core Attributes Exported
The data source exports attributes that describe the caller.
| Attribute | Description |
|---|---|
| account_id | The ID of the AWS account. AWS Account ID number of the account that owns or contains the calling entity. |
| arn | The AWS ARN associated with the calling entity. ARN associated with the calling entity. |
| user_id | The unique identifier of the calling entity. The unique identifier of the calling entity. |
| id | Account ID number of the account that owns or contains the calling. |
Attribute reference from the documentation confirms:
- account_id is set to the ID of the AWS account.
- account_id is The AWS Account ID number of the account that owns or contains the calling entity.
- arn is The AWS ARN associated with the calling entity
- user_id is The unique identifier of the calling entity.
Example outputs demonstrating attribute access:
hcl
output "account_id" {
value = "${data.aws_caller_identity.current.account_id}"
}
output "caller_arn" {
value = "${data.aws_caller_identity.current.arn}"
}
output "caller_user" {
value = "${data.aws_caller_identity.current.user_id}"
}
A more recent syntax example uses direct references:
```hcl
data "awscalleridentity" "current" {}
output "accountid" {
value = data.awscalleridentity.current.accountid
}
output "callerarn" {
value = data.awscalleridentity.current.arn
}
output "calleruser" {
value = data.awscalleridentity.current.user_id
}
```
Configuration Syntax and Example Usage
There are no arguments available for this data source.
A complete minimal usage pattern:
```hcl
provider "aws" {
region = "us-east-1"
}
data "awscalleridentity" "current" {}
output "accountid" {
value = data.awscalleridentity.current.accountid
}
```
The data source is often combined with policy documents that need the caller ARN as a principal:
```hcl
data "awsiampolicy_document" "this" {
statement {
sid = "Default"
actions = ["kms:"]
resources = [""]
principals {
type = "AWS"
identifiers = [data.aws_caller_identity.current.arn]
}
}
}
output "policy" {
value = data.awsiampolicy_document.this.json
}
```
This pattern allows the policy to be built dynamically based on the account making the request.
Provider Interaction and skiprequestingaccount_id
Use this data source to get the access to the effective Account ID in which Terraform is working.
A critical note on behavior:
- an Account ID is only available if skiprequestingaccount_id is not set on the AWS provider. In such cases, the data source will return an error.
This means the provider setting skiprequestingaccount_id controls whether the account ID can be retrieved. If the flag is set to true, the data source cannot obtain an account ID and will error.
The note is explicit:
NOTE on awscalleridentity
- an Account ID is only available if skiprequestingaccount_id is not set on the AWS provider. In such cases, the data source will return an error.
Therefore configurations that rely on account_id must ensure the AWS provider is configured to allow account ID requests.
Assume Role Behavior and Known Issue
When the AWS provider is configured with assume_role, the caller identity reflects the assumed role session.
A reported behavior with Terraform Core Version 1.3.6 and AWS Provider Version 4.46.0 shows:
When providing an IAM role to assume in the provider via assumerole, I would expect that the data source awscaller_identity would return the ARN of the role to be assumed.
Actual behavior observed:
The role ARN returned is an STS session ARN for the SDK
The configuration used in the report:
```hcl
provider "aws" {
region = "us-east-1"
assumerole {
rolearn = "arn:aws:iam::111111111111:role/terraform"
}
}
data "awscalleridentity" "current" {}
data "awsiampolicy_document" "this" {
statement {
sid = "Default"
actions = ["kms:"]
resources = [""]
principals {
type = "AWS"
identifiers = [data.aws_caller_identity.current.arn]
}
}
}
output "policy" {
value = data.awsiampolicy_document.this.json
}
```
The affected resource is awscalleridentity.
This illustrates that with assumerole configured, the arn attribute returned by awscalleridentity may be the STS session ARN created for the SDK rather than the static role ARN provided in assumerole.
Practical Patterns and Considerations
- Dynamic tagging: Use account_id to tag resources with the owning account.
- Cross account references: Build resource names or ARNs using the current account ID.
- Policy generation: Reference caller_arn as a principal in IAM policies as shown above.
- Conditional logic: Use accountid in count or foreach expressions to vary behavior per account.
Common attribute usage summary:
- account_id: used for naming conventions, condition keys, and account scoped references.
- arn: used for principal identification in policies and for resource constraints.
- user_id: used for auditing the specific user or role making the call.
No arguments are accepted for this data source, so its behavior is entirely driven by provider credentials and configuration.
Conclusion
The awscalleridentity data source is a foundational component for dynamic Terraform configurations that need to know which AWS account and identity is active. It provides accountid, arn, userid, and id without requiring arguments, and it depends on the provider being allowed to request account information. The data source integrates directly with provider settings such as assumerole, with the caveat that assumed role sessions may surface as STS session ARNs rather than the static role ARN. The skiprequestingaccountid provider option directly controls availability of account_id and will cause errors when disabled. Because the data source reflects the effective credentials used by Terraform, it remains a reliable mechanism for building self-referencing, account-aware infrastructure code while avoiding hard coded identifiers.