Glossary
GetCallerIdentity
The STS API that returns the account, ARN and user ID behind a set of credentials. It needs no permissions, so it is the first call made with a stolen key.
sts:GetCallerIdentity returns the account ID, ARN and unique ID of the
principal whose credentials signed the request. No permissions are
required to call it, and an explicit deny does not block it.
That makes it the universal "does this key work, and whose is it?" check: it is often the very first event recorded when someone tests a stolen access key. On its own it is harmless — the AWS CLI and many tools call it routinely — so it matters in context: first call from a new IP address, followed by enumeration (MITRE ATT&CK T1087.004).
See how to investigate a leaked AWS access key. Reference: GetCallerIdentity API.