ARN (Amazon Resource Name)
An ARN is AWS’s standardized resource identifier — arn:partition:service:region:account-id:resource — the address used in IAM policies, logging, tagging, and infrastructure-as-code to point at exactly one resource.
Anatomy
The colon-separated parts: partition (aws, aws-cn, aws-us-gov), service (s3, iam, lambda…), region (empty for global services like IAM and S3 bucket names), account-id (empty for resources like S3 buckets and some Layer-1 constructs), and resource — whose shape varies per service: resource-id, resource-type/resource-id, or resource-type:sub-resource.
ARNs support wildcards — arn:aws:s3:::my-bucket/* — which is precisely what makes them dangerous in IAM policies: a wildcarded resource ARN combined with a wildcarded action is the classic over-permission pattern.
Working with them
You parse ARNs to extract account IDs and resource types, build them when writing policies or IaC, and validate them before they land in a JSON policy. Our parser breaks an ARN into components and builds valid ARNs from fields; the IAM validator checks the policies that use them.
Related Terms
Related Standards
- •AWS ARN specification
- •AWS IAM policy language
Free Tools & Resources
Further Reading
Need help with this?
We consult and build across all of these domains — tell us what you are working on.