121

Looking for a quick way to pull my account number, I had originally thought of using aws iam get-account-authorization-details --max-items 1 but there are several issues with doing it this way. Is there a way to do this that might not cross account origins?

ehime
  • 7,079
  • 8
  • 42
  • 101

4 Answers4

251

You can get the account number from the Secure Token Service subcommand get-caller-identity using the following:

aws sts get-caller-identity --query Account --output text
Acumenus
  • 41,481
  • 14
  • 116
  • 107
Taras Alenin
  • 7,196
  • 4
  • 36
  • 29
  • 2
    This should be a much more reliable than security groups since you can delete the default security group. – Justin Jan 20 '17 at 02:37
  • 4
    shorter command if feed to jq `aws sts get-caller-identity|jq -r ".Account"` – BMW Oct 13 '17 at 06:20
  • needed to store in a variable but was getting an extra line, this would be better for that `aws sts get-caller-identity --output json | jq '.Account' | sed 's/\"//g'` – Asim Dec 21 '17 at 07:56
  • For me, it works when I remove the `--query 'Account'` part. – coliveira Sep 18 '18 at 14:15
  • @BMW You unfortunately can't always rely on `jq` being involved or installed on a system. Some servers ban extraneous package installs due to security. You could do something like this `aws sts get-caller-identity --output json |grep Account |awk -F ': "' '{print$2}' |sed 's/\".*//'` but its a little annoying and you might as well do the `--query 'Account' --output text` at that point. – ehime Mar 11 '19 at 15:38
  • @coliveira If you remove `--query Account` then you will get 3 tab-separated values: account number, ARN, and user ID. You would then need to parse that result to get the account number. Better to use `--query Account` or pipe into `jq -r '.Account'`. – jarmod Oct 22 '19 at 13:24
  • @Asim instead of `jq '.Account' | sed 's/\"//g'`, you can use `jq -r '.Account'` (-r for raw output). – jarmod Oct 22 '19 at 13:25
33

From my related answer for the AWS PowerShell CLI, your Account ID is a part of the Arn of resources that you create... and those that are automatically created for you. Some resources will also list you as an OwnerId.

The Default Security Group is automatically created for you in each region's default VPC as a reserved security group. From the documentation:

You can't delete a default security group. If you try to delete the EC2-Classic default security group, you'll get the following error: Client.InvalidGroup.Reserved: The security group 'default' is reserved. If you try to delete a VPC default security group, you'll get the following error: Client.CannotDelete: the specified group: "sg-51530134" name: "default" cannot be deleted by a user.

This makes it a reliable candidate for retrieving our account Id, as long as you are in EC2 classic or have a default VPC (*see edge cases if you don't).

Example:

aws ec2 describe-security-groups \
    --group-names 'Default' \
    --query 'SecurityGroups[0].OwnerId' \
    --output text

This uses --query to filter the output down to the "owner ID" for the first result from this request, and then uses --output to output your account ID as plaintext:

123456781234

Edge cases:

(Thanks @kenchew) Note that if you've deleted your default VPC in a given region, this security group no longer exists and you should use one of these alternative solutions:

Further reading:

Community
  • 1
  • 1
Anthony Neace
  • 21,951
  • 6
  • 100
  • 116
10

If you are running on a server that is running with an assumed role you can't call aws sts get-caller-identity. Also, with describe-security-groups you can't always use the --group-names filter (it doesn't work if you don't have a default VPC), so just pick the first security group. I've found this to be the most reliable regardless of what sort of authentication you use or what sort of VPC you have.

aws ec2 describe-security-groups --query 'SecurityGroups[0].OwnerId' --output text
Mike G
  • 4,022
  • 9
  • 41
  • 63
Philip Kirkland
  • 109
  • 1
  • 2
  • Agree with this. get-caller-identity always seems to return the Users Account, irrespective of the role they have assumed. If you want the assumed role you appear to need to use something like this still (2 years later ..) – suitedupgeek Jun 19 '19 at 08:51
4

My favorite method is to use aws iam get-user [--profile <profile>] since you only need IAM self service role for this to work.

user2976775
  • 41
  • 1