GetCallerIdentity is an AWS Security Token Service (STS) API call that returns the AWS account, user or role, and principal details associated with the credentials being used. It does not require the caller to know its own identity in advance, which makes it a simple way to verify which credentials are active in a session.
In cyber security, this matters because attackers often test stolen keys or temporary tokens to confirm whether they work and what privileges they carry. Defenders also use it during hunts and incident response to validate the identity behind suspicious activity, especially when CloudTrail records show unfamiliar API calls. On its own, the response is not evidence of malicious behavior; it can appear in legitimate automation, scripts, and troubleshooting. Its value comes from correlation with other telemetry such as source IPs, DNS queries, and network flows, which helps analysts determine whether the credentials are being used normally or as part of credential abuse.