Detects bulk AWS STS GetCallerIdentity activity indicating potential credential validation or account enumeration. The rule groups successful GetCallerIdentity calls (excluding AssumedRole sessions) by source IP and source ASN within a 10-minute lookback window and triggers when there are three or more distinct user identities (user.name) observed from the same external address. GetCallerIdentity returns the account and identity behind the credential and requires no permissions, so a burst of different non-role identities from one external address can be suspicious. Exclusions ensure noise from common cloud/carrier networks and certain legitimate patterns: AssumedRole sessions, vault OIDC users, and calls from ASN owners like Amazon, Google, Microsoft, Verizon, and AT&T are ignored. The rule runs every 5 minutes and suppresses alerts for the same source IP for 24 hours to reduce duplication. Alert data includes counts of distinct user identities and ARNs, as well as the relevant source IP, ASN organization, and identity values to aid investigation. Possible investigations should review CloudTrail events around the alert for related activity such as AssumeRole, GetSessionToken, ListUsers, ListBuckets, and DescribeInstances, and correlate with known management hosts or approved automation. Remediation may involve disabling compromised keys, revoking sessions, credential rotation, and auditing resources touched by these identities.