In this blog, I talk about concepts, tips, and tricks related to AWS arn. I will also talk about how to create arn URLs for a specific AWS resource.
I have also added all the important links to AWS resources to quickly build the ARNs you need.
Table of Contents
What is ARN in AWS?
Amazon Resource Names (ARNs) are uniques identifiers assigned to individual AWS resources. It can be an ec2 instance, EBS Volumes, S3 bucket, load balancers, VPCs, route tables, etc.
An ARN looks like the following for an ec2 instance.
arn:aws:ec2:us-east-1:4575734578134:instance/i-054dsfg34gdsfg38
Why are ARNs Important?
ARNs are very important when it comes to IAM policies. You will end up using ARNs if you follow the standard security best practices for IAM roles and policies.
ARNs has the following key use cases.
- They are used in IAM policies for granting restricted granular access to resources. One example is to allow a specific IAM user to access only specific ec2 instances.
- It can be used in automation scripts and API calls to refer to other resources.
If you did not understand the above points, don’t worry, we will look at those with practical examples in the following topics.
AWS ARN format
In most cases, you can build the ARN URL yourself following the below format.
arn:aws:service:region:account-id:resource-id
arn:aws:service:region:account-id:resource-type/resource-id
arn:aws:service:region:account-id:resource-type:resource-id
In the above formats, towards the end, you can see the difference in the formats which changes as per the resource types.
Here are the arn examples for all the three formats.
S3 ARN Example: S3 has a flat hierarchy of buckets and associated objects. Here is how an s3 arn would look like
arn:aws:s3:::devopscube-bucket
EC2 ARN Example: ec2 service has sub resource-types like image, security groups
etc. The following example uses the instance resource-type
.
arn:aws:ec2:us-east-1:4575734578134:instance/i-054dsfg34gdsfg38
Lambda ARN Example: Lambda functions can have multiple versions. Here the version is the qualifier. To have arn of the specific Lambda version, you need to mention the version number at the last as shown below
arn:aws:lambda:us-east-1:4575734578134:function:api-fucntion:1
How to get the ARNs of AWS resources?
If you are getting started with AWS, you may find it difficult to put together the correct arn URL for a resource.
You can find the syntax for ARNs for all the AWS services here.
For example, in that AWS document, if you go ec2 resource from the list, and scroll down to the “Resource Types Defined by Amazon EC2” section, you will find the reference for all the sub rsource types for ec2 as shown below.
Another way is to use the aws policy generator.
In the policy generator, when you select the policy resource, it will automatically show the arn suggestion as shown below. You just need to add resource information.
ARN Wildcards
ARN definition supports wildcards. You will need wildcard in many use cases.
Let say you want a IAM policy which allows access to all objects in a single bucket. For this you can have a wildcard arn like below.
arn:aws:s3:::my-data-bucket/*
Here is an example of using wildcard arn in an IAM policy. This policy allows all actions for dcubebucke
t S3 bucket.
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "Stmt1596173683332",
"Action": "s3:*",
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::dcubebucket",
"arn:aws:s3:::dcubebucket/*"
]
}]
}
Here is another example policy which allows limted access to all emr clusters.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1596174145144",
"Action": [
"elasticmapreduce:AddInstanceFleet",
"elasticmapreduce:AddTags",
"elasticmapreduce:DescribeCluster",
"elasticmapreduce:DescribeEditor",
"elasticmapreduce:DescribeJobFlows",
"elasticmapreduce:DescribeSecurityConfiguration"
],
"Effect": "Allow",
"Resource": "arn:aws:elasticmapreduce:*:*:cluster/*"
}
]
}
Getting ARN from AWS CLI
You can get the ARNs of specific resources from the CLI.
For all IAM roles, policies and users, you can get the ARN from the CLI by describing it.
Here is an example of getting arn of a role.
aws iam get-role --role-name EMR_DefaultRole
Here is output with the arn.
Like this you can try describing the resource and see if it outputs the arn.
Getting ARN from AWS Console
You can get the arn of IAM resources directly from AWS console.
Just browse to the specific resource and you will find the related arn at the top as shown below.
Getting ARN as Output in Cloudformation
If you are using Cloudformation, you can get the resource arn in the output with the function Fn::GetAtt
Here is an example syntax of getting getting the arn of a Lambda function.
resources:
Outputs:
LamdaFunctionArn:
Export:
Name: MyFucntionARN
Value:
Fn::GetAtt: MyLambdaFunction.Arn
Getting ARNs of Principal
When you create an S3 bucket policy, SNS topic, VPC endpoint, and SQS policies, you need to specify a principal parameter.
Principal
Is the trusted source specified as an ARN in the policy to allow or deny access to the resource.
For example, if you want an s3 bucket to be accessed only by a specific user, you will specify the user arn as Principal
in the policy.
If you use a Policy generator to create these policies, you will see the principal option as shown below.
Primarily you specify the user, account, and role arn as the principal. There are other Principal sources as well. Please see this AWS document to learn more.
Getting the User arn
If you brows to the user page in AWS console, you will get the user arn as shown below.
AWS Account arn
AWS account arn has the following syntax. Replace account-id
with your account id.
arn:aws:iam::<account-id>:root
Getting AWS Role arn
You can get the arn of the IAM role from the cli as explained in the above section.
If you go to IAM –> Role –> Your role from the web console, you can view the arn as shown below.
Note: If you are working with an ec2 instance, you might need the instance profile arn with the IAM policies.
Wrapping Up
I have added some of the resources and tricks I use for aws arn.
I would like to hear from you.
Please let me some scenarios you have come across in the comments section.
10 comments
Amazon vendor new EDI to API. I am not a technical person, and we’re looking to update our IAM ARN to get business and sales reports for our API. Anyone able to help with that?
I have a question about this topic I can’t find an answer for. Most the wildcard in resource examples are very basic. I have a fairly deep complex heirarchy of “folders” and in each section there is one folder that somewhere in its name, has the word “private”. I am making a GROUP ACL in IAM, and trying to figure out how to use a wildcard a folder name — it could be anywhere in a ‘path’ from ./onelevel/here to ./1/2/3/4/5/6/here — to basically say, “for this whole group, don’t allow a list/get/anything for any folder which contains the string ‘private’. Is it even possible to do this, do you know??
Hi Palyne,
Are you talking about s3 folders?
Thanks quite useful
Very well explained.2 mins read and got everything .
Thanks, Satyam. Glad it helped! 🙂
This is good but how about the Principals?
Hi Jovonned,
Thanks.I will update the Principals as well.
5 stars on this. Very well laid out and easy to understand. Thank you!
Glad it helped Nick!