title: “AWS ARNs (Amazon Resource Names)” created: 2026-07-20 updated: 2026-07-20 type: knowledge tags:

aws
security
iam
certification

AWS ARNs (Amazon Resource Names)

What It Is

An ARN is a globally unique identifier for any AWS resource. It is the standard way to reference resources in IAM policies, bucket policies, and API calls.

Why It Matters

You cannot write any IAM or resource policy without using ARNs. Understanding the format lets you quickly construct and debug policy statements.

Key Concepts

General Format

arn:partition:service:region:account-id:resource

Field	Description	Example
partition	AWS partition	`aws` (standard), `aws-cn` (China), `aws-us-gov` (GovCloud)
service	AWS service namespace	`s3`, `iam`, `ec2`, `lambda`
region	AWS Region	`us-east-1`, `eu-west-1` (blank if global)
account-id	AWS account number	`123456789012` (blank if not required)
resource	Resource identifier	Varies by service

S3 ARN Specifics

S3 is a global service — the region and account-id fields are left blank (but the colons remain):

arn:aws:s3:::mybucket          → the bucket itself
arn:aws:s3:::mybucket/*        → all objects in the bucket
arn:aws:s3:::mybucket/reports/* → objects under the reports/ prefix

IAM Role ARN

arn:aws:iam::123456789012:role/EC2InstanceProfileRole

Region is blank (IAM is global)
Account ID is present
Resource type is role/ followed by role name

Common Patterns

Resource	ARN Pattern
S3 bucket	`arn:aws:s3:::bucket-name`
S3 objects	`arn:aws:s3:::bucket-name/*`
IAM role	`arn:aws:iam::account:role/role-name`
IAM user	`arn:aws:iam::account:user/user-name`
EC2 instance	`arn:aws:ec2:region:account:instance/i-xxx`
Lambda function	`arn:aws:lambda:region:account:function:name`

Gotchas

Forgetting colons for blank fields is a common mistake: arn:aws:s3:::bucket not arn:aws:s3:bucket
S3 bucket ARN vs object ARN: use bucket ARN for ListBucket, object ARN (/*) for GetObject/PutObject
ARNs are case-sensitive for the resource portion

AWS Certification Notes