How to test credentials for AWS Command Line Tools

Question

Is there a command/subcommand that can be passed to the aws utility that can 

1) verify that the credentials in the ~/.aws/credentials file are valid, and 

2) give some indication which user the credentials belong to? 

I'm looking for something generic that doesn't make any assumptions about the user having permissions to IAM or any specific service. The use case for this is a deploy-time sanity check to make sure that the credentials are good. Ideally there would be some way to check the return value and abort the deploy if there are invalid credentials.

Answer 1

This command would work irrespective of the IAM policies

>aws sts get-caller-identity

The output of this command would be

{
    "Account": "123456789012", 
    "UserId": "AR#####:#####", 
    "Arn": "arn:aws:sts::123456789012:assumed-role/role-name/role-session-name"
}

The credentials can be found easily based on the error codes starting from 0-255

0-success

1-limited S3 commands

255- Command fail,etc

Answer 2

This command always works regardless of the IAM permission

>aws sts get-caller-identity

you will get the output as
{
    "UserId": "################"
    "Account": "9876543221",
    "Arn": "arn:aws:iam::9876543221:user/content"
}

It uses error codes from 0-255 to specify the type of credentials

like 0 for success, 1 for S3 commands and 255 for command fail