Get Caller Identity

Status: test
Severity: low
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

The "whoami" for AWS. Attackers will often use this to determine the identity of the current user or role. This is a common first step in AWS reconnaissance. After stealing long-term or short-term access keys, attackers often run aws sts get-caller-identity to determine the identity of the compromised user or role. Any IAM user or role can call this API, and it is often used in scripts to verify the identity of the caller.

Known false positives

Users trying to determine their identity in AWS and/or testing their access key validity.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	No specific technique

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `GetCallerIdentity`: Returns details about the IAM user or role whose credentials are used to call the operation.

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: Get Caller Identity
id: 0e854216-b78f-4e05-9d62-1314cf16bb40
status: test
description: |
    The "whoami" for AWS. Attackers will often use this to determine the identity of the current user or role. This is a common first step in AWS reconnaissance.
    After stealing long-term or short-term access keys, attackers often run `aws sts get-caller-identity` to determine the identity of the compromised user or role.
    Any IAM user or role can call this API, and it is often used in scripts to verify the identity of the caller.
references:
    - https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/
author: Zach Mathis (@yamatosecurity)
date: 2025-04-24
modified: 2025-05-31
tags:
    - attack.discovery
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'GetCallerIdentity'
    condition: selection
falsepositives:
    - Users trying to determine their identity in AWS and/or testing their access key validity.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventName: 'GetCallerIdentity'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`GetCallerIdentity`	`field:"aws::eventName" kind:eq value:"GetCallerIdentity"`