[New Rule] AWS GetCallerIdentity API Called for the First Time

[imays11]

Issues

• https://github.com/elastic/ia-trade-team/issues/346

Summary

Identifies the use of sts:GetCallerIdentity API function. This is equivalent to whoami in linux and provides the caller with the user identity information for the set of credentials being used. A legitimate user would likely not need to make this call as they know who they are, and this is especially suspicious behavior coming from a service like Lambda or an EC2 instance role. GetCallerIdentity does not require any permissions as it returns the same information even when explicit deny policies are in place that deny access to the API. For this reason I've decided not to include event.outcome: success as part of the query.

This is a new_terms rule as some operations may need to call the GetCallerIdentity function as part of their authorization process. For example, an AWS EKS token, the authentication token used when communicating with the Kubernetes API server, includes a pre-signed AWS API request for sts:GetCallerIdentity which allows the aws-iam-authenticator to determine the AWS Identity and attached permissions for each request.

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[terrancedejesus]

Added some suggestions for this rule. Once fixed, LGTM!