aws sts get-caller-identity: Usage & Common CI Errors

The "who am I" check for AWS - confirm exactly which identity your job has.

aws sts get-caller-identity returns the account, user/role ARN, and user ID of the credentials the CLI is currently using. It is the fastest way to verify authentication in CI before doing real work.

What it does

The command calls AWS STS and echoes back the caller’s Account, UserId, and Arn for whatever credentials resolved. It requires no special permission (every identity may call it), so it is the canonical early step to prove a CI job assumed the role you expected.

Common usage

# Show the current identity
aws sts get-caller-identity

# Extract just the account ID (scriptable)
aws sts get-caller-identity --query Account --output text

# Assert the assumed-role ARN in CI
aws sts get-caller-identity --query Arn --output text

Common error in CI: wrong or missing identity

In CI you see "Unable to locate credentials" (nothing assumed) or the returned Arn is an unexpected role - a sign OIDC assumed the wrong IAM role or fell back to a default profile. Fix: run get-caller-identity right after credential setup and assert the Arn matches the intended role; if it is missing, confirm configure-aws-credentials ran with the correct role-to-assume and that the OIDC trust policy’s sub/aud conditions match your repo and token.actions.githubusercontent.com.

Key options

Related guides