Ask AWS who you are

Learn

"Who am I?"

aws sts get-caller-identity is the cloud version of whoami. It asks STS (the Security Token Service) which identity your credentials belong to:

{
    "UserId": "AKIAIOSFODNN7EXAMPLE",
    "Account": "000000000000",
    "Arn": "arn:aws:iam::000000000000:root"
}

Account is the 12-digit AWS account the request runs in. The mock uses all zeros.
Arn is an Amazon Resource Name, the globally unique name of the caller. ARNs follow one pattern everywhere: arn:aws:<service>:<region>:<account>:<resource>. IAM is global, so its region field is empty (iam::).
UserId is the unique id behind that identity.

It needs no permissions at all, so it works with any valid credentials. That makes it the first command to run when something fails with "access denied": before debugging the policy, check you're the identity, in the account, that you think you are.

Your task

Feedback Report a problem

Every AWS command is really an API call to a service. Start with the simplest one: ask AWS who you're authenticated as. Add this line to the script and press Run:

aws sts get-caller-identity

You'll see an account id and an ARN come back as JSON.

Ask AWS who you are

"Who am I?"

Your task

Output