Article by Phil Massyn.

Enumerate AWS Account ID from an EC2 Instance

With shell or command line access to an EC2 instance, you will be able to determine some key information about the AWS account.

get-caller-identity

By using get-caller-identity, the EC2 instance may have an EC2 instance profile setup.

user@host:$ aws sts get-caller-identity
{
   "Account": "000000000000",
   "UserId": "AROAJIWIJQ5KCHMJX4EWI:i-00000000000000000",
   "Arn": "arn:aws:sts::000000000000:assumed-role/AmazonLightsailInstanceRole/i-00000000000000000"
}

Metadata

By using the metadata service, you will be able to retrieve additional information about the account, and more specifically for the EC2 instance being used.

TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/dynamic/instance-identity/document

The output will reveal additional information.

{
   "accountId" : "000000000000",
   "architecture" : "x86_64",
   "availabilityZone" : "ap-southeast-2a",
   "billingProducts" : null,
   "devpayProductCodes" : null,
   "marketplaceProductCodes" : null,
   "imageId" : "ami-042c4533fa25c105a",
   "instanceId" : "i-00000000000000000",
   "instanceType" : "t2.nano",
   "kernelId" : null,
   "pendingTime" : "2022-02-27T22:34:30Z",
   "privateIp" : "172.26.6.225",
   "ramdiskId" : null,
   "region" : "ap-southeast-2",
   "version" : "2017-09-30"
}