How to Terraform Get Current Account ID: A Complete Guide to `aws_caller_identity`

Use the aws_caller_identity data source to query the current AWS account ID dynamically without hard-coding values in your configuration.

When writing Terraform configurations for AWS infrastructure, you often need the numeric account identifier for naming resources, constructing ARNs, or applying conditional logic. The most straightforward way to terraform get current account id is through the built-in aws_caller_identity data source, which queries the AWS STS GetCallerIdentity API automatically during the planning phase.

Declaring the aws_caller_identity Data Source

The aws_caller_identity data source requires zero arguments. When you declare it, Terraform triggers a ReadDataSource request through the provider protocol defined in [internal/tfplugin6/tfplugin6_grpc.pb.go](https://github.com/hashicorp/terraform/blob/main/internal/tfplugin6/tfplugin6_grpc.pb.go). This gRPC method is the standard interface all providers implement for fetching read-only data.

data "aws_caller_identity" "current" {}

According to the AWS provider implementation in [terraform-provider-aws/internal/service/sts/data_source_caller_identity.go](https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/sts/data_source_caller_identity.go), this declaration causes the provider to invoke the AWS STS GetCallerIdentity API. The response contains three attributes: account_id, arn, and user_id.

Accessing the Account ID Attribute

Once declared, reference the account ID using the interpolation syntax data.aws_caller_identity.<NAME>.account_id. This value returns as a string containing the 12-digit AWS account number.

resource "aws_s3_bucket" "example" {
  bucket = "company-logs-${data.aws_caller_identity.current.account_id}"
  tags = {
    OwnerAccount = data.aws_caller_identity.current.account_id
  }
}

The data source persists throughout the configuration lifecycle, allowing you to reference data.aws_caller_identity.current.account_id in multiple resources, modules, and outputs without additional API calls.

Practical Configuration Examples

Dynamic IAM Policy Construction

Use the account ID to build secure, account-specific IAM policy documents without hard-coding identifiers:

data "aws_caller_identity" "current" {}

resource "aws_iam_policy" "cross_account_access" {
  name = "cross-account-s3-access"
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = "s3:GetObject"
        Resource = "arn:aws:s3:::shared-bucket-${data.aws_caller_identity.current.account_id}/*"
      }
    ]
  })
}

Conditional Resource Creation

Filter resources based on the execution account to prevent accidental deployments in production environments:

locals {
  is_production = data.aws_caller_identity.current.account_id == "123456789012"
}

resource "aws_instance" "app" {
  count         = local.is_production ? 5 : 1
  instance_type = local.is_production ? "m5.large" : "t3.micro"
  ami           = "ami-12345678"
}

Technical Implementation Details

The retrieval process follows a structured provider protocol. When Terraform encounters the data source, it executes the ReadDataSource gRPC method found in the core codebase at [internal/tfplugin6/tfplugin6_grpc.pb.go](https://github.com/hashicorp/terraform/blob/main/internal/tfplugin6/tfplugin6_grpc.pb.go).

The AWS provider handles this request in [data_source_caller_identity.go](https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/sts/data_source_caller_identity.go) by:

1. Initializing an AWS STS client
2. Calling the GetCallerIdentity API endpoint
3. Mapping the response fields to Terraform attributes
4. Returning the account_id as a computed string value

Because the data source executes during the refresh phase, the account ID is available immediately for resource planning, unlike resources that depend on creation-time API calls.

Summary

• Use aws_caller_identity as the standard method to terraform get current account id without manual configuration.
• Zero arguments required—simply declare the data source and reference data.aws_caller_identity.current.account_id.
• Implementation resides in the AWS provider's STS service package at internal/service/sts/data_source_caller_identity.go.
• Core protocol handling occurs through Terraform's ReadDataSource gRPC method in internal/tfplugin6/tfplugin6_grpc.pb.go.
• Common applications include S3 bucket naming, IAM policy ARN construction, and environment-based conditional logic.

Frequently Asked Questions

Do I need to pass any arguments to the aws_caller_identity data source?

No. The aws_caller_identity data source accepts no required or optional arguments. It automatically uses the AWS credentials configured in your provider block to authenticate with STS and retrieve the current caller identity.

What is the difference between the aws_caller_identity data source and resource?

There is no aws_caller_identity resource—only a data source. Data sources are read-only objects that fetch existing information, whereas resources create or manage infrastructure. The account ID is an inherent property of your AWS credentials, not something you create or modify through Terraform.

Can I use aws_caller_identity inside Terraform modules?

Yes. Pass the data source reference into modules as input variables, or declare the data source directly within the module. Since the data source requires no arguments, it works identically in root configurations and nested modules without additional provider configuration.

Does calling this data source incur AWS charges or API throttling?

No. AWS STS GetCallerIdentity calls are free of charge and do not count against API rate limits in a way that impacts typical Terraform usage. The call occurs during every plan and apply operation, but it is a lightweight read operation designed for high-frequency identity verification.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}