Detection of Unauthorized AWS STS GetCallerIdentity Discovery

Adversaries frequently target AWS environments by leveraging stolen IAM credentials to conduct discovery and lateral movement. A common reconnaissance tactic is the use of the AWS Security Token Service (STS) GetCallerIdentity API, which provides details about the IAM user or role associated with the credentials currently in use. This operation requires no specific permissions and returns consistent information even if access to other resources is denied, making it a low-noise method for attackers to verify if their hijacked credentials are valid and to map their current environment context. This threat is particularly concerning because legitimate human users rarely need to call this API, as they are typically aware of the account context in which they are operating. Monitoring for the first-time usage of this API by specific identities provides a reliable signal for identifying credential abuse, provided that automated service accounts are appropriately tuned out of the detection logic.

Impact

Successful abuse of the GetCallerIdentity API indicates that an attacker has gained a functional foothold in an AWS account using compromised credentials. This discovery phase allows the attacker to confirm their access level before proceeding with more aggressive actions, such as resource enumeration, sensitive data exfiltration, or persistence establishment. If undetected, this initial access can lead to significant data breaches and unauthorized control over cloud infrastructure.

Recommendation

Detection engineering teams should implement monitoring for the GetCallerIdentity event within AWS CloudTrail, specifically focusing on the first instance of an identity performing this call.

• Deploy the provided detection logic to your SIEM to alert on anomalous GetCallerIdentity calls from non-service identities.
• Establish a baseline of known-good service accounts and automated tooling that legitimately use this API to reduce false positives.
• Integrate CloudTrail logs with security analytics platforms and tune alerts by excluding known user_agent.original strings associated with infrastructure-as-code tools like Terraform or Pulumi.
• Conduct periodic reviews of IAM permissions and enable multi-factor authentication (MFA) for all IAM users to mitigate the risk of credential compromise.