ARNs

Amazon Resource Names (ARNs) are standardized identifiers used by Amazon Web Services (AWS) to uniquely identify resources across accounts and regions. ARNs enable precise reference in policies, APIs, and configuration files, and are a core part of access control and resource management in AWS.

The typical ARN format is: arn:partition:service:region:account-id:resource-type/resource-id. Each component has a purpose: partition indicates the AWS partition (for example, aws, aws-us-gov, or aws-cn); service denotes the AWS service (such as iam, s3, dynamodb); region is the geographic region; account-id is a 12-digit AWS account number; and the resource portion identifies the specific resource. Some services use a slash syntax (resource-type/resource-id), others a colon (resource-type:resource-id), and some use only a resource-id or a more complex path. Regions can be omitted for global resources in certain services.

Examples:

- arn:aws:iam::123456789012:user/Alice

- arn:aws:s3:::my_corporate_bucket/logs/2024/

- arn:aws:dynamodb:us-west-2:123456789012:table/Movies

Usage and scope:

ARNs are used in IAM policies to grant or restrict access, in API calls and SDKs to specify target resources, and within infrastructure-as-code tools (such as CloudFormation and Terraform) to reference resources. They also appear in resource-based policies and cross-account access configurations.

Notes:

Most AWS resources have ARNs, though some services or resource types may use alternative identifiers or have service-specific naming nuances. The exact ARN structure can vary by service, so consulting service-specific documentation is recommended when constructing ARNs.