Amazon Resource Name (ARN)
Amazon Resource Names — the globally unique addressing scheme for every AWS resource, and the string format that IAM policies are actually written against.
Last reviewed: July 25, 2026
What is an ARN?
An Amazon Resource Name uniquely identifies any AWS resource with a structured string: arn:aws:service:region:account-id:resource. Every bucket, function, role, queue, and key has one, and — more importantly — ARNs are the language IAM policies speak. When a policy grants s3:GetObject on arn:aws:s3:::my-bucket/*, that Resource ARN is what turns a broad permission into a scoped one. Understanding ARN structure is therefore inseparable from writing least-privilege policies.
Reading the anatomy — and its irregularities
The fields carry meaning: partition (aws, aws-cn, aws-us-gov), service, region, account, and a resource part whose format varies by service — sometimes resource-type/resource-id, sometimes resource-type:resource-id, sometimes just resource-id. Global services (S3, IAM) leave region and/or account blank, which is why arn:aws:s3:::bucket has those empty colons. This per-service inconsistency is the practical friction: you cannot reliably parse ARNs with one universal regex, and policies that assume a uniform format break on the exceptions.
Where ARNs decide security outcomes
The wildcard is the whole game. Resource: "*" grants an action on every resource of that type in the account — the difference between “read this one bucket” and “read every bucket,” expressed entirely in the ARN pattern. Scoped ARNs with path prefixes (arn:aws:s3:::app-data/tenant-123/*) implement per-tenant isolation; over-broad ARNs are how least privilege quietly fails. Cross-account access, resource policies, and condition keys all hinge on getting ARN patterns exactly right.
What people get wrong
Resource: "*"by reflex — the single most common way IAM policies grant far more than intended.- Assuming uniform ARN format across services and writing parsers that break on the exceptions.
- Copying ARNs across regions/accounts without updating the embedded region and account-ID fields — a silent mismatch that denies access confusingly.
Primary source: AWS — Amazon Resource Names reference
ARN Structure and Its Practical Uses
An Amazon Resource Name follows a structured format (arn:partition:service:region:account-id:resource) that uniquely and unambiguously identifies any resource across all of AWS, regardless of resource type — this uniform structure is what allows IAM policies to reference specific resources precisely (arn:aws:s3:::my-bucket/* for objects in a specific bucket, for example), rather than relying on resource names alone, which could collide across different accounts or services. Understanding ARN structure is a practical, everyday skill for anyone writing IAM policies or working with AWS APIs and CLI tools, since nearly every AWS API call that references a specific resource does so via its ARN rather than a simpler name or ID.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.