<p>Well, from a security point of view, it's never bad to give people less information.</p>

<p>But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered secret.</p>

<p>For example, if you know the arn of the role I use to access s3 from my EC2 instances, you can't do anything with that information unless I give you permission to assume that role from one of your roles.  Between accounts, this is a very explicit and bidirectional action; so it will not happen by accident/without you knowing.</p>

<p>Losing the credentials to an IAM user could let people assume roles and would be terrible, but them knowing the arn alone does nothing for them.</p>

CC BY-SA 4.0
2020-03-23T18:33:44.240Z
I somewhat agree with giving people less information is never bad. While I agree less information won't result in something being less secure, I also strongly believe that "security by obscurity" is not a viable tactic. Hindering development processes to obscure data rather than digging into the source of your security issue (in this case having insecure IAM roles) is not a good practice. You always have to assume that if someone really wants your information, obscuring it won't work in the long run. I do agree though that locking down and giving specific access is much more important.
Preston Martin
CC BY-SA 4.0
2020-03-23T21:40:05.367Z
Wholeheartedly agree :).
John Humphreys
CC BY-SA 4.0
2020-03-18T17:08:20.027Z
2020-03-18T17:14:10.583Z
2020-03-18T17:14:10.583Z
John Humphreys
<p>I have a configuration file that contains AWS resource ARNs stored in a git repo. This includes some ARNs of AWS IAM role resources. Should these be treated as if they are a secret value, and not stored in a repository?</p>

<amazon-web-services><aws-iam><secret-management>
Should AWS arn values be treated as secrets?
Preston Martin
# Should AWS arn values be treated as secrets?

(Asked by: username_0 on 2020-03-18)

I have a configuration file that contains AWS resource ARNs stored in a git repo. This includes some ARNs of AWS IAM role resources. Should these be treated as if they are a secret value, and not stored in a repository?

**Tags:** amazon-web-services, aws-iam, secret-management


---

## 1 answers

### Answer by username_1 on 2020-03-18. Score: 15 | Accepted answer

Well, from a security point of view, it's never bad to give people less information.

But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered secret.

For example, if you know the arn of the role I use to access s3 from my EC2 instances, you can't do anything with that information unless I give you permission to assume that role from one of your roles. Between accounts, this is a very explicit and bidirectional action; so it will not happen by accident/without you knowing.

Losing the credentials to an IAM user could let people assume roles and would be terrible, but them knowing the arn alone does nothing for them.

> **Comments:**
> **username_0**: I somewhat agree with giving people less information is never bad. While I agree less information won't result in something being less secure, I also strongly believe that "security by obscurity" is not a viable tactic. Hindering development processes to obscure data rather than digging into the source of your security issue (in this case having insecure IAM roles) is not a good practice. You always have to assume that if someone really wants your information, obscuring it won't work in the long run. I do agree though that locking down and giving specific access is much more important.  
> **username_1**: Wholeheartedly agree :).  

---

