<p><a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html</a> lists the schema for (I believe) all of the ARNs that Amazon supports.  Text in italic red indicates where you should substitute in your own value, rather than the literal string, and there are examples in each section to help figure this out.</p>

<p>Be warned that IAM is less usefully restrictive than it appears on first glance.  To start with, most services <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html" rel="nofollow noreferrer">have only partial IAM support</a>.  Secondly, often the things that are supported at a resource level are supported only in very specific ways; for instance, granting all permissions on a subnet ARN does not grant the attached users the ability to fully manage instances in that subnet, as <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-supported-iam-actions-resources.html" rel="nofollow noreferrer"><code>AttachVolume</code> only supports restricting by volume id</a>, etc.  Thirdly, if the users are going to use the Amazon web console at all, they must have broad viewing permissions, as the console was not written with PoLP in mind and issues non-resource-restricted API calls (and often merely dumps errors in the javascript console!).</p>

CC BY-SA 3.0
2017-06-03T19:35:28.540Z
2017-09-25T20:49:55.717Z
2017-09-25T20:49:55.717Z
Xiong Chiamiov
<p>I am creating an <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html" rel="noreferrer">AWS IAM</a> policy for a Serverless Framework project, I am applying the <a href="https://en.wikipedia.org/wiki/Principle_of_least_privilege" rel="noreferrer">Principle of Least Privilege</a> to ensure the policy is as tight as possible.  To restrict the scope of the policy I need to be able to identify the <a href="http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html" rel="noreferrer">ARN</a> for each of the resources, i.e.:</p>

<pre><code>arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*
</code></pre>

<p>Looking through the CloudWatch and CloudFormation UIs I can't actually see any mention of the resulting ARN for a created log group.</p>

<p><em>Question: For any resource within Amazon Web Services how can I obtain the ARN?</em></p>

CC BY-SA 3.0
2017-05-21T12:23:24.237Z
In `arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*`... what they are trying to tell you is that `log-group` is a fixed, literal string and `my-log-group` is the actual name of *your* log group... but it is not presented in a way that makes it obvious.  Things that start with `my-` seem to be how they indicate the places where you would substitute the specific resource name.  Is that what you're trying to figure out?  Otherwise, your question contains a link to the answer, so it isn't clear what you're asking.
Michael - sqlbot
CC BY-SA 3.0
2017-05-21T16:26:08.813Z
@Michael-sqlbot I had assumed as much, specific to log groups, however, there appear to be two names if I were to create a log group for Lambda it would end up with a Logical ID of `HelloLogGroup` and a Physical ID of `/aws/lambda/my-service-dev-hello`.  Now I can just plug these on to the end of what I do know about the ARN and see if it works. I was hoping there was a more deterministic way of deriving the ARN for any given arbitray resource.
Richard Slater
<amazon-web-services><aws-iam>
How to get the ARN for an arbitrary Amazon Resource?
Richard Slater
# How to get the ARN for an arbitrary Amazon Resource?

(Asked by: username_0 on 2017-05-21)

I am creating an AWS IAM policy for a Serverless Framework project, I am applying the Principle of Least Privilege to ensure the policy is as tight as possible.  To restrict the scope of the policy I need to be able to identify the ARN for each of the resources, i.e.:
arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*

Looking through the CloudWatch and CloudFormation UIs I can't actually see any mention of the resulting ARN for a created log group.
Question: For any resource within Amazon Web Services how can I obtain the ARN?

**Tags:** amazon-web-services, aws-iam

> **Comments:**
> **username_1**: In `arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*`... what they are trying to tell you is that `log-group` is a fixed, literal string and `my-log-group` is the actual name of *your* log group... but it is not presented in a way that makes it obvious.  Things that start with `my-` seem to be how they indicate the places where you would substitute the specific resource name.  Is that what you're trying to figure out?  Otherwise, your question contains a link to the answer, so it isn't clear what you're asking.  
> **username_0**: @Michael-sqlbot I had assumed as much, specific to log groups, however, there appear to be two names if I were to create a log group for Lambda it would end up with a Logical ID of `HelloLogGroup` and a Physical ID of `/aws/lambda/my-service-dev-hello`.  Now I can just plug these on to the end of what I do know about the ARN and see if it works. I was hoping there was a more deterministic way of deriving the ARN for any given arbitray resource.  

---

## 1 answers

### Answer by username_2 on 2017-06-03. Score: 5 | Accepted answer

<https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html> lists the schema for (I believe) all of the ARNs that Amazon supports. Text in italic red indicates where you should substitute in your own value, rather than the literal string, and there are examples in each section to help figure this out.

Be warned that IAM is less usefully restrictive than it appears on first glance. To start with, most services [have only partial IAM support](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html). Secondly, often the things that are supported at a resource level are supported only in very specific ways; for instance, granting all permissions on a subnet ARN does not grant the attached users the ability to fully manage instances in that subnet, as [`AttachVolume` only supports restricting by volume id](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-supported-iam-actions-resources.html), etc. Thirdly, if the users are going to use the Amazon web console at all, they must have broad viewing permissions, as the console was not written with PoLP in mind and issues non-resource-restricted API calls (and often merely dumps errors in the javascript console!).


---

