How Lambda Proves Identity: SigV4 Assertions
When a Lambda function needs to prove who it is, it uses its dynamically rotated IAM Execution Role credentials.If you are calling an external, non-AWS third party that needs cryptographic proof of your Lambda's identity, you can simulate an identity document using a SigV4 Presigned STS Request (often called the sts:GetCallerIdentity trick).
How the "GetCallerIdentity" Trick Works:
Instead of sending a JWT, your Lambda function creates a cryptographic signature using its current IAM identity and hands that signature to the third party.
The Lambda generates a request:
Inside your Lambda code, you generate a presigned URL for the AWS Security Token Service (STS) GetCallerIdentity API action.The Cryptographic Proof: Generating this URL automatically signs the request using the Lambda’s active, unique IAM Execution Role. This acts exactly like a temporary, cryptographically signed identity document.The Lambda sends the payload: The Lambda transmits this presigned URL (along with the necessary headers) to the external third-party system.
The Third Party Verifies: The external system executes an HTTP GET request to that exact presigned URL.If it fails: The signature was tampered with or expired.If it succeeds: AWS STS will return a JSON payload directly to the third party confirming the exact AWS Account ID, User ID, and the unique Lambda IAM Role ARN that generated the signature.
┌──────────────┐ ┌─────────────┐ ┌─────────┐
│ AWS Lambda │─(Generates URL)─>│ External API│─(Forwards URL)─>│ AWS STS │
│ Workload │ │ Receiver │ │ Service │
└──────────────┘ └─────────────┘ └─────────┘
│ │ │
└─────────[ Sends Presigned URL ]┘ │
└───────[ Returns Role ARN ]───┘
This pattern is widely utilized by zero-trust systems (such as HashiCorp Vault's AWS Auth Method) to verify the identity of a serverless function without requiring any shared secrets.
How Lambda Proves Identity: SigV4 Assertions
When a Lambda function needs to prove who it is, it uses its dynamically rotated IAM Execution Role credentials.If you are calling an external, non-AWS third party that needs cryptographic proof of your Lambda's identity, you can simulate an identity document using a SigV4 Presigned STS Request (often called the sts:GetCallerIdentity trick).
How the "GetCallerIdentity" Trick Works:
Instead of sending a JWT, your Lambda function creates a cryptographic signature using its current IAM identity and hands that signature to the third party.
The Lambda generates a request:
Inside your Lambda code, you generate a presigned URL for the AWS Security Token Service (STS) GetCallerIdentity API action.The Cryptographic Proof: Generating this URL automatically signs the request using the Lambda’s active, unique IAM Execution Role. This acts exactly like a temporary, cryptographically signed identity document.The Lambda sends the payload: The Lambda transmits this presigned URL (along with the necessary headers) to the external third-party system.
The Third Party Verifies: The external system executes an HTTP GET request to that exact presigned URL.If it fails: The signature was tampered with or expired.If it succeeds: AWS STS will return a JSON payload directly to the third party confirming the exact AWS Account ID, User ID, and the unique Lambda IAM Role ARN that generated the signature.
This pattern is widely utilized by zero-trust systems (such as HashiCorp Vault's AWS Auth Method) to verify the identity of a serverless function without requiring any shared secrets.