Programmatically get Account Id from lambda context arn

Question

I have access to

com.amazonaws.services.lambda.runtime.Context;

object and by extension the invoked function Arn. The arn contains the account Id where the lambda resides.

My question is simple, I want the cleanest way to extract the account Id from that.

I was taking a look

com.amazon.arn.ARN;

It has a whole bunch of stuff, but no account ID (which i presume is due to the fact that not all arns have account ids ?)

I want to cleanly extract the account Id, without resorting to parsing the string.

Answer 1

If your lambda is being used as an API Gateway proxy lambda, then you have access to event.requestContext.accountId (where event is the first parameter to your handler function).

Otherwise, you will have to split the ARN up.

From the AWS documentation about ARN formats, here are the valid Lambda ARN formats:

arn:aws:lambda:region:account-id:function:function-name

arn:aws:lambda:region:account-id:function:function-name:alias-name

arn:aws:lambda:region:account-id:function:function-name:version

arn:aws:lambda:region:account-id:event-source-mappings:event-source-mapping-id

In all cases, account-id is the 5th item in the ARN (treating : as a separator). Therefore, you can just do this:

String accountId = arn.split(":")[4];

Answer 2

You no longer need to parse the arn anymore, sts library has introduced get_caller_identity for this purpose. Its an overkill, but works!.

Excerpts from aws docs.

python

import boto3

client = boto3.client('sts')
response = client.get_caller_identity()['Account']

js

/* This example shows a request and response made with the credentials for a user named Alice in the AWS account 123456789012. */

 var params = {
 };
 sts.getCallerIdentity(params, function(err, data) {
   if (err) console.log(err, err.stack); // an error occurred
   else     console.log(data);           // successful response
   /*
   data = {
    Account: "123456789012", 
    Arn: "arn:aws:iam::123456789012:user/Alice", 
    UserId: "AKIAI44QH8DHBEXAMPLE"
   }
   */
 });

More details here & here

Answer 3

I use this:

ACCID:  { "Fn::Join" : ["", [{ "Ref" : "AWS::AccountId" }, "" ]] }