Quick way to get AWS Account number from the AWS CLI tools?

Question

You can get the account number from the Secure Token Service subcommand get-caller-identity using the following:

aws sts get-caller-identity --query Account --output text

From my related answer for the AWS PowerShell CLI, your Account ID is a part of the Arn of resources that you create... and those that are automatically created for you. Some resources will also list you as an OwnerId.

The Default Security Group is automatically created for you in each region's default VPC as a reserved security group. From the documentation:

You can't delete a default security group. If you try to delete the EC2-Classic default security group, you'll get the following error: Client.InvalidGroup.Reserved: The security group 'default' is reserved. If you try to delete a VPC default security group, you'll get the following error: Client.CannotDelete: the specified group: "sg-51530134" name: "default" cannot be deleted by a user.

This makes it a reliable candidate for retrieving our account Id, as long as you are in EC2 classic or have a default VPC (*see edge cases if you don't).

Example:

aws ec2 describe-security-groups \
    --group-names 'Default' \
    --query 'SecurityGroups[0].OwnerId' \
    --output text

This uses --query to filter the output down to the "owner ID" for the first result from this request, and then uses --output to output your account ID as plaintext:

123456781234

Edge cases:

(Thanks @kenchew) Note that if you've deleted your default VPC in a given region, this security group no longer exists and you should use one of these alternative solutions:

• query STS get-caller-identity, per @Taras
• use the first security group returned, per @Phillip

Further reading:

• AWS EC2 Documentation: Default Security Groups
• AWS CLI Documentation: aws ec2 describe-security-groups
• Controlling Command Output from the AWS Command Line Interface

If you are running on a server that is running with an assumed role you can't call aws sts get-caller-identity. Also, with describe-security-groups you can't always use the --group-names filter (it doesn't work if you don't have a default VPC), so just pick the first security group. I've found this to be the most reliable regardless of what sort of authentication you use or what sort of VPC you have.

aws ec2 describe-security-groups --query 'SecurityGroups[0].OwnerId' --output text

My favorite method is to use aws iam get-user [--profile <profile>] since you only need IAM self service role for this to work.