Amazon Resource Names (ARNs) format cheat sheet


This cheat sheet shows a complete overview of 300+ Amazon Resource Names (ARNs) references that you can apply to IAM policies within AWS.

In the official documentation, you find a general reference guide on using ARNs, that’s helpful to a certain extent, but when you want to apply permissions on AWS resources, then you need the prefix name of the AWS service and the ARN in order to deny or allow actions on it.

ARNs uniquely identify AWS resources across all of AWS. The general format for an ARN looks like this:

arn:partition:service:region:account-id:resource-id
arn:partition:service:region:account-id:resource-type/resource-id
arn:partition:service:region:account-id:resource-type:resource-id
  • partition – is the location where the resource is located. The available options are: aws, aws-cn and aws-us-gov.
  • service – is the AWS service name that’s being used as a reference. For the ARN format, you need to use the service prefix name (2nd column in the table below).
  • region – is the region that’s being used in your AWS account for the deployment of your AWS services/resources e.g. eu-central-1 for the data center in Frankfurt.
  • account-id – is the ID of the AWS account that owns the resource, this typically consists of 12 numbers, and here are instructions on how to find it on your account.
  • resource-id – is a unique identifier to distinguish multiple resources from the same AWS resource.
  • resource-type – AWS Services contain different types of resources, hence the resource type attribute. This lets you specify the resource in a more granular detail e.g. the service Amazon EC2 has a resource type called VPC.

A complete list of ARNs reference formats

The table is split up into 3 columns that help you to find the right ARN for the AWS resource. So use the find feature in the browser, type in the AWS Service name e.g. Amazon S3 and you’ll see the service prefix name and the ARN format.

Service nameService prefix nameARN Format
AWS Account Managementaccountarn:aws:account::${Account}:account
AWS Amplify Adminamplifybackendarn:aws:amplifybackend:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Amplify UI Builderamplifyuibuilderarn:aws:amplifyuibuilder:${Region}:${AccountId}}:${ResourceType}/${ResourceName}
AWS Amplifyamplifyarn:aws:amplify:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS App Mesh Previewappmesh-previewarn:aws:appmesh-preview:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS App Meshappmesharn:aws:appmesh:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS App Runnerapprunnerarn:aws:apprunner:${Region}:${Account}:${ResourceType}/${PathToResource}
AWS App2Containera2carn:${Partition}:a2c:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS AppConfigappconfigarn:aws:appconfig:${Region}:${Account}:${RelativeId}
AWS AppSyncappsyncarn:aws:appsync:${Region}:${Account}:${ResourceType}/${ResourcePath}
AWS Application Migration Servicemgnarn:aws:mgn:${Region}:${AccountId}:${ResourceType}/${ResourceName}
AWS Artifactartifactarn:aws:artifact::${resource}
AWS Audit Managerauditmanagerarn:aws:auditmanager:::${ResourceType}/${ResourceName}
AWS Backup Gatewaybackup-gatewayarn:aws:backup-gateway:${Region}:${Account}:${ResourceType}/${ResourcePath}
AWS Backup storagebackup-storagearn:aws:backup-storage:${region}:${account-id}:${resource-type}:${resource_name}
AWS Backupbackuparn:aws:backup:${Region}:${Account}:${ResourceType}:${ResourceName}
AWS Batchbatcharn:aws:batch:${Region}:${Account}:${ResourceType}/${ResourcePath}
AWS Billing Conductorbillingconductorarn:aws:billingconductor::${Account}:${ResourceType}
AWS Budget Servicebudgetsarn:aws:budgets::${account_ID}:budget/${budgetname}
AWS BugBustbugbustarn:aws:bugbust:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Certificate Manageracmarn:aws:acm:${Region}:${AccountId}:${ArnType}/${ResourceId}
AWS Chatbotchatbotarn:aws:chatbot::${Account}:chat-configuration/${ConfigurationType}/${ChatbotConfigurationName}
AWS Cloud Control APIcloudformationarn:aws:cloudformation:${Region}:${Account}:${RelativeId}
AWS Cloud Mapservicediscoveryarn:aws:servicediscovery:${Region}:${AccountId}:${ResourceType}/${ResourceName}
AWS Cloud9cloud9arn:aws:cloud9:${Region}:${Account}:${ResourceType}:${ResourceId}
AWS CloudFormationcloudformationarn:aws:cloudformation:${Region}:${Account}:${ResourceType}/${Id}
AWS CloudHSMcloudhsmarn:${partition}:cloudhsm:${region}:${accountID}:${relative-id}
AWS CloudShellcloudshellarn:aws:cloudshell:${Region}:${Account}:environment/${EnvironmentId}
AWS CloudTrailcloudtrailarn:aws:cloudtrail:${Region}:${Account}:${Resource}
AWS CloudWatch RUMrumarn:aws:rum:${Region}:${Account}:appmonitor/${Name}
AWS CodeArtifactcodeartifactarn:aws:codeartifact:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS CodeBuildcodebuildarn:aws:codebuild:${Region}:${Account}:build/${BuildId}
AWS CodeCommitcodecommitarn:aws:codecommit:${Region}:${Account}:${RepositoryName}
AWS CodeDeploycodedeployarn:aws:codedeploy:${Region}:${Account}:${ResourceType}:${ResourceSpecifier}
AWS CodePipelinecodepipelinearn:aws:codepipeline:${Region}:${Account}:${PathToPipelineResource}
AWS CodeStar Connectionscodestar-connectionsarn:aws:codestar-connections:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS CodeStar Notificationscodestar-notificationsarn:aws:codestar-notifications:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS CodeStarcodestararn:aws:codestar:${Region}:${Account}:project/${ResourceId}
AWS Configconfigarn:aws:config:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS Connector Serviceawsconnectorarn:aws:${serviceName}:${region}:${account-id}:${resource-type}/${resource_name}
AWS Control Towercontroltowerarn:${Partition}:controltower:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Cost Explorer Servicecearn:aws:ce::${AccountId}:${ResourceType}/${ResourceName}
AWS Cost and Usage Reportcurarn:aws:cur:${region}:${account_ID}:definition/${reportname}
AWS Data Exchangedataexchangearn:aws:dataexchange:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS DataSyncdatasyncarn:aws:datasync:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Database Migration Servicedmsarn:aws:dms:${Region}:${Account}:${Resource}
AWS DeepComposerdeepcomposerarn:aws:deepcomposer:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS DeepLensdeeplensarn:aws:deeplens:${region}:${account-id}:${resource-type}/${resource_name}
AWS DeepRacerdeepracerarn:aws:deepracer:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Device Farmdevicefarmarn:aws:devicefarm:${Region}:${Account}:${ResourceType}:${ResourceId}
AWS Direct Connectdirectconnectarn:aws:directconnect:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS Directory Servicedsarn:aws:ds:${Region}:${Account}:${RelativeId}
AWS Elastic Beanstalkelasticbeanstalkarn:aws:elasticbeanstalk:${Region}:${AccountID}:${ResourceType}/${PathToResource}
AWS Elastic Disaster Recoverydrsarn:aws:drs:${Region}:${AccountId}:${ResourceType}/${ResourceName}
AWS Elemental Appliances and Software Activation Serviceelemental-activationsarn:aws:elemental-activations:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Elemental Appliances and Softwareelemental-appliances-softwarearn:aws:elemental-appliances-software:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Elemental MediaConnectmediaconnectarn:aws:mediaconnect:${Region}:${Account}:${namespace}:${relative-id}:${relative-name}
AWS Elemental MediaConvertmediaconvertarn:aws:mediaconvert:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS Elemental MediaLivemedialivearn:aws:medialive:${Region}:${Account}:${ResourceType}:${ResourceId}
AWS Elemental MediaPackage VODmediapackage-vodarn:aws:mediapackage-vod:${Region}:${Account}:${ResourceType}/${ResourceIdentifier}
AWS Elemental MediaPackagemediapackagearn:aws:mediapackage:${Region}:${Account}:${ResourceType}/${ResourceIdentifier}
AWS Elemental MediaStoremediastorearn:aws:mediastore:${Region}:${Account}:${Resource}
AWS Elemental MediaTailormediatailorarn:aws:mediatailor:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Elemental Support Caseselemental-support-casesarn:${Partition}:elemental-support-cases:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Elemental Support Contentelemental-support-contentarn:${Partition}:elemental-support-content:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Fault Injection Simulatorfisarn:aws:fis:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Firewall Managerfmsarn:aws:fms:${Region}:${Account}:${Resource}/${Id}
AWS Global Acceleratorglobalacceleratorarn:aws:globalaccelerator::${Account}:accelerator/${AcceleratorId}
AWS Glue DataBrewdatabrewarn:aws:databrew:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS Gluegluearn:aws:glue:${Region}:${Account}:${ResourceType}/${ResourcePath}
AWS Ground Stationgroundstationarn:aws:groundstation:${Region}:${AccountID}:${ResourceType}/${ResourceId}
AWS Health APIs and Notificationshealtharn:aws:health::${Namespace}:${RelativeId}
AWS IAM Access Analyzeraccess-analyzerarn:aws:access-analyzer:${Region}:${Account}:analyzer/${AnalyzerName}
AWS IAM Identity Center (successor to AWS Single Sign-On) directorysso-directoryarn:${Partition}:sso-directory:${Region}:${Account}:${RelativeId}
AWS IAM Identity Center (successor to AWS Single Sign-On)ssoarn:aws:sso:::${RelativeId}
AWS IQ Permissionsiq-permissionarn:${Partition}:iq-permission:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS IQiqarn:${Partition}:iq:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Identity Store Authidentitystore-autharn:${Partition}:identitystore-auth:${Region}:${Account}:${RelativeId}
AWS Identity Storeidentitystorearn:aws:identitystore::${AwsAccountId}:${ResourceType}/${ResourceId}
AWS Identity Syncidentity-syncarn:aws:identity-sync:${Region}:${Account}:${ResourceType}/${ResourcePath}
AWS Identity and Access Management Roles Anywhererolesanywherearn:aws:rolesanywhere:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS IoT 1-Clickiot1clickarn:aws:iot1click:${Region}:${Account}:${Type}/${Name}
AWS IoT Analyticsiotanalyticsarn:aws:iotanalytics:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS IoT Core Device Advisoriotdeviceadvisorarn:aws:iotdeviceadvisor:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS IoT Core for LoRaWANiotwirelessarn:aws:iotwireless:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS IoT Device Testeriot-device-testerarn:${Partition}:iot-device-tester:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS IoT Eventsioteventsarn:aws:iotevents:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS IoT Fleet Hub for Device Managementiotfleethubarn:aws:iotfleethub:${Region}:${AccountId}:${ResourceType}/${ResourceName}
AWS IoT FleetWiseiotfleetwisearn:aws:iotfleetwise:${Region}:${Account}:${Type}/${Name}
AWS IoT Greengrass V2greengrassarn:aws:greengrass:${Region}:${Account}:${ResourceType}:${ResourcePath}
AWS IoT Greengrassgreengrassarn:aws:greengrass:${Region}:${Account}:/greengrass/${ResourceType}/${ResourcePath}
AWS IoT Jobs DataPlaneiotjobsdataarn:aws:iot:${Region}:${Account}:${Type}/${Name}
AWS IoT RoboRunneriotroborunnerarn:aws:iotroborunner:${Region}:${Account}:${ResourceType}/${ResourcePath}
AWS IoT SiteWiseiotsitewisearn:aws:iotsitewise:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS IoT TwinMakeriottwinmakerarn:aws:iottwinmaker:${Region}:${Account}:${ResourceType}/${ResourceTypeId}
AWS IoTiotarn:aws:iot:${Region}:${Account}:${Type}/${Name}
AWS Key Management Servicekmsarn:aws:kms:${Region}:${Account}:${ResourceType}/${Id}
AWS Lake Formationlakeformationarn:${Partition}:lakeformation:${Region}:${Account}:${ResourceType}/${ResourcePath}
AWS Lambdalambdaarn:aws:lambda:${Region}:${Account}:${ResourceType}:${ResourceId}
AWS License Managerlicense-managerarn:aws:license-manager:${Region}:${Account}:${ResourceType}:${ResourceId}
AWS Mainframe Modernization Servicem2arn:aws:m2:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS Marketplace Catalogaws-marketplacearn:aws:aws-marketplace:${Region}:${Account}:${Catalog}/${ResourceType}/${ResourceId}
AWS Marketplace Vendor Insightsvendor-insightsarn:aws:vendor-insights:::${ResourceType}:${ResourceId}
AWS Microservice Extractor for .NETserviceextractarn:aws:serviceextract:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Migration Hub Orchestratormigrationhub-orchestratorarn:aws:migrationhub-orchestrator:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Migration Hub Refactor Spacesrefactor-spacesarn:aws:refactor-spaces:${Region}:${Account}:${ResourceType}/${RelativeId}
AWS Migration Hub Strategy Recommendationsmigrationhub-strategyarn:${Partition}:iam:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Migration Hubmgharn:aws:mgh:${region}:${namespace}:${relative-id}
AWS Mobile Hubmobilehubarn:aws:mobilehub:${region}:${aws_account_ID}:project/${project_ID}
AWS Network Firewallnetwork-firewallarn:aws:network-firewall:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Network Managernetworkmanagerarn:aws:networkmanager::${AccountId}:${ResourceType}/${ResourceName}
AWS OpsWorks Configuration Managementopsworks-cmarn:aws:opsworks-cm:${region}:${account}:${resourceType}/${id}
AWS OpsWorksopsworksarn:aws:${ServiceName}:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Organizationsorganizationsarn:aws:organizations::${Account}:${Resource}/o-${OrganizationId}(/${ResourceType}/${ResourceId})?
AWS Outpostsoutpostsarn:aws:outposts:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Panoramapanoramaarn:aws:panorama:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Performance Insightspiarn:aws:pi:${Region}:${Account}:${ResourceType}/${RelativeId}
AWS Private Certificate Authorityacm-pcaarn:aws:acm-pca:${Region}:${Account}:${ARNType}/${ResourceId}
AWS Protonprotonarn:aws:proton:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Purchase Orders Consolepurchase-ordersarn:aws:purchase-orders:${region}:${account-id}:${resource-type}/${resource_name}
AWS Recycle Binrbinarn:aws:rbin:${Region}:${Account}:rule/${ResourceName}
AWS Resilience Hub Serviceresiliencehubarn:aws:resiliencehub:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS Resource Access Managerramarn:aws:ram:${Region}:${AccountId}:resource-share/${ResourceUUID}
AWS Resource Groupsresource-groupsarn:aws:resource-groups:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS RoboMakerrobomakerarn:aws:robomaker:${Region}:${AccountId}:${ResourceType}/${ResourceName}
AWS SQL Workbenchsqlworkbencharn:aws:sqlworkbench:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Savings Planssavingsplansarn:aws:savingsplans::${Account}:${ResourceType}/${ResourcePath}
AWS Secrets Managersecretsmanagerarn:aws:secretsmanager:${Region}:${Account}:secret:${SecretId}
AWS Security Hubsecurityhubarn:aws:securityhub:${Region}:${Account}:.+
AWS Security Token Servicestsarn:aws:iam::${Account}:${RelativeId}
AWS Server Migration Servicesmsarn:aws:${serviceName}:${region}:${account-id}:${resource-type}/${resource_name}
AWS Serverless Application Repositoryserverlessrepoarn:aws:serverlessrepo:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS Service Catalogservicecatalogarn:aws:(catalog|servicecatalog):${Region}:${Account}:${ResourceType}/${Id}
AWS Shieldshieldarn:aws:shield::${Account}:${Resource}/${ResourceId}
AWS Signersignerarn:aws:signer:${Region}:${Account}:/${ResourceType}/${ResourceIdentifier}
AWS Snow Device Managementsnow-device-managementarn:aws:snow-device-management:${region}:${account-id}:${resource-type}/${resource_name}
AWS Step Functionsstatesarn:aws:${serviceName}:${region}:${account}:${resourceType}:${resourceName}
AWS Storage Gatewaystoragegatewayarn:aws:storagegateway:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Support Planssupportplansarn:${Partition}:supportplans::${Account}:${ResourceType}/${ResourcePath}
AWS Sustainabilitysustainabilityarn:${Partition}:sustainability:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Systems Manager Incident Manager Contactsssm-contactsarn:aws:ssm-contacts:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS Systems Manager Incident Managerssm-incidentsarn:aws:ssm-incidents::${Account}:${ResourceType}/${ResourceId}
AWS Systems Managerssmarn:aws:ssm:${Region}:${Account}:${RelativeId}
AWS Tag Editorresource-explorerarn:aws:resource-explorer:${region}:${account-id}:${resource-type}/${resource_name}
AWS Tirostirosarn:${Partition}:tiros:${Region}:${Account}:${RelativeId}
AWS Transfer Familytransferarn:aws:transfer:${Region}:${Account}:${ResourceType}/${ResourceName}
AWS Trusted Advisortrustedadvisorarn:aws:trustedadvisor:${Region}:${Account}:checks/${Category}/${CheckId}
AWS WAF Regionalwaf-regionalarn:aws:waf-regional:${Region}:${Account}:${ResourceId}/${Id}
AWS WAF V2wafv2arn:aws:wafv2:${Region}:${Account}:${Scope}/${ResourceType}/${ResourceName}/${ResourceId}
AWS WAFwafarn:aws:waf::${Account}:${ResourceId}/${Id}
AWS Well-Architected Toolwellarchitectedarn:aws:wellarchitected:${Region}:${Account}:${ResourceName}/${ResourceId}
AWS X-Rayxrayarn:aws:xray:${Region}:${Account}:${ResourceType}/${ResourceId}
AWS service providing managed private networksprivate-networksarn:aws:private-networks:${Region}:${Account}:${RelativeId}
Alexa for Businessa4barn:aws:a4b:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon API Gateway Management V2apigatewayarn:aws:apigateway:${Region}::${ApiGatewayResourcePath}
Amazon API Gateway Managementapigatewayarn:aws:apigateway:${Region}::${ApiGatewayResourcePath}
Amazon API Gatewayexecute-apiarn:aws:execute-api:${region}:${account_id}:${api_id}/${stage}/${method}/${api_specific_resource_path}
Amazon AppFlowappflowarn:aws:appflow:{Region}:{AccountId}:{ResourceType}/{ResourceName}
Amazon AppIntegrationsapp-integrationsarn:aws:app-integrations:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon AppStream 2.0appstreamarn:aws:appstream:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon Athenaathenaarn:aws:athena:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon Braketbraketarn:aws:braket:{$Region}:{$AccountI}}:.+
Amazon Chimechimearn:aws:chime:${Region}:${Account}:${ResourceType}/${ResourceID}
Amazon Cloud Directoryclouddirectoryarn:aws:clouddirectory::${Region}:${Account}:${RelativeId}
Amazon CloudFrontcloudfrontarn:aws:cloudfront:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon CloudSearchcloudsearcharn:aws:cloudsearch:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon CloudWatch Evidentlyevidentlyarn:aws:evidently:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon CloudWatch Logslogsarn:aws:logs:.+:.+:.+
Amazon CloudWatch Syntheticssyntheticsarn:aws:synthetics:${Region}:${Account}:${ResourceType}:${ResourceName}
Amazon CloudWatchcloudwatcharn:aws:cloudwatch:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon CodeGuru Profilercodeguru-profilerarn:aws:codeguru-profiler:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon CodeGuru Reviewercodeguru-reviewerarn:aws:codeguru-reviewer:${Region}:${Account}:${ResourceType}:${ResourceName}
Amazon CodeGurucodeguruarn:${Partition}:codeguru:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Cognito Identitycognito-identityarn:aws:cognito-identity:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon Cognito Synccognito-syncarn:aws:cognito-sync:${Region}:${Account}:${ResourceType}/${ResourcePath}:
Amazon Cognito User Poolscognito-idparn:aws:cognito-idp:${Region}:${Account}:${ResourceType}/${ResourcePath}:
Amazon Comprehend Medicalcomprehendmedicalarn:${Partition}:comprehendmedical:${Region}:${AccountId}:${ResourceType}/${ResourceName}
Amazon Comprehendcomprehendarn:aws:comprehend:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Connect Casescasesarn:aws:cases:${Region}:${Account}:
Amazon Connect Customer Profilesprofilearn:aws:profile:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Connect Voice IDvoiceidarn:aws:voiceid:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Connect Wisdomwisdomarn:aws:wisdom:${Region}:${Account}:${Resource}/${ResourceId}
Amazon Connectconnectarn:aws:connect:${Region}:${Account}:instance/${InstanceId}
Amazon Data Lifecycle Managerdlmarn:aws:dlm:${Region}:${Account}:policy/${ResourceName}
Amazon Detectivedetectivearn:aws:detective:${Region}:${Account}:graph:${GraphId}
Amazon DevOps Gurudevops-guruarn:aws:devops-guru:${Region}:${Account}:
Amazon DynamoDB Accelerator (DAX)daxarn:aws:dax:${Region}:${Account}:cache/${ClusterName}
Amazon DynamoDBdynamodbarn:aws:dynamodb:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon EC2 Auto Scalingautoscalingarn:aws:autoscaling:${Region}:${Account}:${RelativeId}
Amazon EC2 Image Builderimagebuilderarn:aws:imagebuilder:${Region}:${AccountId}:${ResourceType}/${ResourceName}
Amazon EC2 Instance Connectec2-instance-connectarn:aws:ec2:${region}:${account}:${resourceType}/${resourcePath}
Amazon EC2ec2arn:aws:ec2:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon EMR Serverlessemr-serverlessarn:aws:emr-serverless:${Region}:${Account}:/${ResourceType}/${ResourcePath}
Amazon EMR on EKS (EMR Containers)emr-containersarn:aws:emr-containers:${Region}:${Account}:/${ResourceType}/${ResourcePath}
Amazon ElastiCacheelasticachearn:aws:elasticache:${Region}:${AccountId}:${ResourceType}:${ResourceName}
Amazon Elastic Block Storeebsarn:aws:ebs:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon Elastic Container Registry Publicecr-publicarn:aws:ecr-public::${Account}:${RepositoryOrRegistry}/${RepositoryNameOrAccountId}
Amazon Elastic Container Registryecrarn:aws:ecr:${Region}:${Account}:repository/${RepositoryName}
Amazon Elastic Container Serviceecsarn:aws:ecs:${Region}:${Account}:${ResourceType}/${RelativeId}
Amazon Elastic File Systemelasticfilesystemarn:aws:elasticfilesystem:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon Elastic Inferenceelastic-inferencearn:aws:elastic-inference:${region}:${account-id}:elastic-inference-accelerator/${identifier}
Amazon Elastic Kubernetes Serviceeksarn:aws:eks:${Region}:${Account}:${ResourceType}/${RelativeId}
Amazon Elastic MapReduceelasticmapreducearn:aws:elasticmapreduce:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Elastic Transcoderelastictranscoderarn:aws:elastictranscoder:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon EventBridge Schemasschemasarn:aws:schemas:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon EventBridgeeventsarn:aws:events:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon FSxfsxarn:aws:fsx:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon FinSpacefinspacearn:aws:finspace:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon Forecastforecastarn:aws:forecast:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Fraud Detectorfrauddetectorarn:aws:frauddetector:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon FreeRTOSfreertosarn:aws:freertos:${Region}:${Account}:${Type}/${Name}
Amazon GameLiftgameliftarn:aws:gamelift:${Region}:${AccountId}:${ResourceType}/${ResourceId}
Amazon GameSparksgamesparksarn:aws:gamesparks:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon GroundTruth Labelinggroundtruthlabelingarn:${Partition}:groundtruthlabeling:${region}:${account}:${resourceType}/${resourcePath}
Amazon GuardDutyguarddutyarn:aws:guardduty:${Region}:${Account}:.+
Amazon HealthLakehealthlakearn:aws:healthlake:${Region}:${AccountId}:${ResourceType}/${ResourceName}
Amazon Honeycodehoneycodearn:aws:honeycode:${Region}:${Account}:${ResourceType}:${ResourcePath}
Amazon Inspector2inspector2arn:aws:inspector2:${Region}:${Account}:.+
Amazon Interactive Video Service Chativschatarn:aws:ivschat:${Region}:${AccountId}:${ResourceType}/${ResourceId}
Amazon Interactive Video Serviceivsarn:aws:ivs:${Region}:${Account}:${ArnType}/${ResourceId}
Amazon Kendrakendraarn:aws:kendra:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Keyspaces (for Apache Cassandra)cassandraarn:aws:cassandra:${Region}:${Account}:/${ResourceType}/${ResourcePath}/
Amazon Kinesis Analytics V2kinesisanalyticsarn:aws:kinesisanalytics:${Region}:${Account}:application/${ApplicationName}
Amazon Kinesis Analyticskinesisanalyticsarn:aws:kinesisanalytics:${Region}:${Account}:application/${ApplicationName}
Amazon Kinesis Firehosefirehosearn:aws:firehose:{Region}:{Account}:deliverystream/${DeliveryStreamName}
Amazon Kinesis Video Streamskinesisvideoarn:aws:kinesisvideo:${Region}:${Account}:${ResourceType}/${ResourceName}/${CreationTime}
Amazon Kinesiskinesisarn:aws:kinesis:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Lex V2lexarn:aws:lex:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Lexlexarn:aws:lex:${Region}:${Account}:${Type}:${Name}
Amazon Lightsaillightsailarn:aws:lightsail:${Region}:${Account}:${ResourceType}/${Id}
Amazon Locationgeoarn:aws:geo:${Region}:${AccountId}:${ResourceType}/${ResourceName}
Amazon Lookout for Equipmentlookoutequipmentarn:aws:lookoutequipment:${Region}:${Account}:${ResourceType}/${ResourceName}/${ResourceId}
Amazon Lookout for Metricslookoutmetricsarn:aws:lookoutmetrics:${Region}:${AccountId}:${ResourceType}:${ResourceName}
Amazon Lookout for Visionlookoutvisionarn:aws:lookoutvision:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon MQmqarn:aws:mq:${Region}:${Account}:.+
Amazon Machine Learningmachinelearningarn:aws:machinelearning:${Region}:${Account}:${ResourceType}/${RelativeID}
Amazon Maciemacie2arn:aws:macie2:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Managed Blockchainmanagedblockchainarn:aws:managedblockchain:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Managed Grafanagrafanaarn:aws:grafana:${Region}:${Account}:/${ResourceType}/${ResourceId}
Amazon Managed Service for Prometheusapsarn:aws:aps:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Managed Streaming for Apache Kafkakafkaarn:aws:kafka:${Region}:${Account}:${ResourceType}/${ResourceName}/${Uuid}
Amazon Managed Streaming for Kafka Connectkafkaconnectarn:aws:kafkaconnect:${Region}:${Account}:${ResourceType}/${ResourceName}/${UUID}
Amazon Managed Workflows for Apache Airflowairflowarn:aws:airflow:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon MemoryDBmemorydbarn:aws:memorydb:${Region}:${AccountId}:${ResourceType}/${ResourceName}
Amazon Monitronmonitronarn:aws:monitron:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Neptuneneptune-dbarn:aws:neptune-db:${Region}:${Account}:${Id}/*
Amazon Nimble Studionimblearn:aws:nimble:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon OpenSearch Serviceesarn:aws:es:${Region}:${Account}:${Resource}
Amazon Personalizepersonalizearn:aws:personalize:${Region}:${Account}:${Resourcename}/${ResourceId}
Amazon Pinpoint Email Servicesesarn:aws:ses:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Pinpoint SMS Voice V2sms-voicearn:aws:sms-voice:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Pinpoint SMS and Voice Servicesms-voicearn:aws:sms-voice:${region}:${account-id}:${resource-type}/${resource_name}
Amazon Pinpointmobiletargetingarn:aws:mobiletargeting:${Region}:${Account}:.+
Amazon Pollypollyarn:aws:polly:${region}:${accountID}:lexicon/${relative-id}
Amazon QLDBqldbarn:aws:qldb:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon QuickSightquicksightarn:aws:quicksight:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon RDS Data APIrds-dataarn:aws:rds:${Region}:${Account}:${RelativeId}
Amazon RDS IAM Authenticationrds-dbarn:aws:rds-db:${region}:${account-id}:dbuser:${dbi-resource-id}/${db-user-name}
Amazon RDSrdsarn:aws:rds:${Region}:${Account}:${RelativeId}
Amazon RHEL Knowledgebase Portalrhelkbarn:aws:rhelkb:${Region}:${AccountId}:${ResourceType}/${ResourceName}
Amazon Redshift Data APIredshift-dataarn:aws:redshift-serverless:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Redshift Serverlessredshift-serverlessarn:aws:redshift-serverless:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon Redshiftredshiftarn:aws:redshift:${Region}:${Account}:${RelativeId}
Amazon Rekognitionrekognitionarn:aws:rekognition:${Region}:${Account}:${RelativeId}
Amazon Route 53 Recovery Clusterroute53-recovery-clusterarn:aws:route53-recovery-control::${Account}:${ResourceType}/${ResourceName}
Amazon Route 53 Recovery Controlsroute53-recovery-control-configarn:aws:route53-recovery-control::${Account}:${ResourceType}/${ResourceName}
Amazon Route 53 Recovery Readinessroute53-recovery-readinessarn:aws:route53-recovery-readiness::${Account}:${ResourceType}/${ResourceName}
Amazon Route 53 Resolverroute53resolverarn:aws:route53resolver:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Route 53route53arn:aws:route53:::${Resource}/{$Id}
Amazon S3 Glacierglacierarn:aws:glacier:${Region}:${Account}:vault/${VaultName}
Amazon S3 Object Lambdas3-object-lambdaarn:aws:s3-object-lambda:::accesspoint/${access point name}
Amazon S3 on Outpostss3-outpostsarn:aws:s3-outposts:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon S3s3arn:aws:s3:::${BucketName}/${KeyName}
Amazon SESsesarn:aws:ses:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon SNSsnsarn:aws:sns:${Region}:${Account}:${TopicName}
Amazon SQSsqsarn:aws:sqs:${Region}:${AccountID}:${QueueName}
Amazon SageMaker Ground Truth Syntheticsagemaker-groundtruth-syntheticarn:${Partition}:sagemaker-groundtruth-synthetic:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon SageMakersagemakerarn:aws:sagemaker:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon Simple Email Service v2sesarn:aws:ses:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon Simple Workflow Serviceswfarn:aws:swf:${Region}:${Account}:/domain/${DomainName}
Amazon SimpleDBsdbarn:aws:sdb:${Region}:${Account}:domain/${DomainName}
Amazon Sumeriansumerianarn:aws:sumerian:${Region}:${Account}:${ResourceType}/${ResourcePath}
Amazon Textracttextractarn:${Partition}:textract:${Region}:${AccountID}:${RelativeId}
Amazon Timestreamtimestreamarn:aws:timestream:${Region}:${Account}:database/${DatabaseName}/table/${TableName}
Amazon Transcribetranscribearn:aws:transcribe:${Region}:${AccountId}:${ResourceType}/${ResourceName}
Amazon Translatetranslatearn:aws:translate:${Region}:${Account}:${ResourceType}/${ResourceName}
Amazon WorkLinkworklinkarn:aws:worklink::${Account}:${ResourceType}/${ResourcePath}
Amazon WorkMail Message Flowworkmailmessageflowarn:aws:workmailmessageflow:${Region}:${Account}:message/${OrganizationId}/${Context}/${MessageId}
Amazon WorkMailworkmailarn:aws:workmail:${Region}:${Account}:${ResourceType}/${ResourceId}
Amazon WorkSpaces Webworkspaces-webarn:aws:workspaces-web:${Region}:${Account}:${ResourceType}/${ResourceIdentifier}
Amazon WorkSpacesworkspacesarn:aws:workspaces:${Region}:${Account}:*
AmazonMediaImportmediaimportarn:aws:mediaimport:${Region}:${Account}/*
Apache Kafka APIs for Amazon MSK clusterskafka-clusterarn:aws:kafka:${Region}:${Account}:${ResourceType}/${ResourceDescriptor}
Database Query Metadata Servicedbqmsarn:${Partition}:dbqms::
Elastic Load Balancing V2elasticloadbalancingarn:aws:elasticloadbalancing:${Region}:${Account}:${ResourceType}/${ResourceId}
Elastic Load Balancingelasticloadbalancingarn:aws:elasticloadbalancing:${Region}:${Account}:${ResourceType}/${ResourceId}
High-volume outbound communicationsconnect-campaignsarn:aws:connect-campaigns:${Region}:${Account}:campaign/${CampaignId}
Identity And Access Managementiamarn:aws:iam::${Namespace}:${RelativeId}
Service Quotasservicequotasarn:aws:servicequotas:${Region}:${Account}:${ResourceType}/${ResourceName}
A table containing a complete list of ARNs for all AWS Services

Note: The data was collected by using a script that reads the assets that are used by the AWS Policy Generator.

You can bookmark this page so use you can revisit it later to look up other ARN formats and prefix names quickly when creating your IAM policies.

I’ve also created cheat sheets for CloudFormation properties and attributes to help you develop infrastructure and code more quickly.


Danny Steenman

Is a Principal Cloud Consultant with a background in DevOps Engineering and thorough hands-on experience in architecting and building highly scalable distributed systems on AWS Cloud using Infrastructure as Code.

A prominent leader who is passionate about sharing AWS technical expertise by writing technical articles.