Amazon Resource Name (ARN)
Amazon Resource Names — the globally unique addressing scheme for every AWS resource, and the string format that IAM policies are actually written against.
What is an ARN?
An Amazon Resource Name uniquely identifies any AWS resource with a structured string: arn:aws:service:region:account-id:resource. Every bucket, function, role, queue, and key has one, and — more importantly — ARNs are the language IAM policies speak. When a policy grants s3:GetObject on arn:aws:s3:::my-bucket/*, that Resource ARN is what turns a broad permission into a scoped one. Understanding ARN structure is therefore inseparable from writing least-privilege policies.
Reading the anatomy — and its irregularities
The fields carry meaning: partition (aws, aws-cn, aws-us-gov), service, region, account, and a resource part whose format varies by service — sometimes resource-type/resource-id, sometimes resource-type:resource-id, sometimes just resource-id. Global services (S3, IAM) leave region and/or account blank, which is why arn:aws:s3:::bucket has those empty colons. This per-service inconsistency is the practical friction: you cannot reliably parse ARNs with one universal regex, and policies that assume a uniform format break on the exceptions.
Where ARNs decide security outcomes
The wildcard is the whole game. Resource: "*" grants an action on every resource of that type in the account — the difference between “read this one bucket” and “read every bucket,” expressed entirely in the ARN pattern. Scoped ARNs with path prefixes (arn:aws:s3:::app-data/tenant-123/*) implement per-tenant isolation; over-broad ARNs are how least privilege quietly fails. Cross-account access, resource policies, and condition keys all hinge on getting ARN patterns exactly right.
What people get wrong
Resource: "*"by reflex — the single most common way IAM policies grant far more than intended.- Assuming uniform ARN format across services and writing parsers that break on the exceptions.
- Copying ARNs across regions/accounts without updating the embedded region and account-ID fields — a silent mismatch that denies access confusingly.
Primary source: AWS — Amazon Resource Names reference
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.