AWS ARN
technology.cloud.aws_arnAmazon Resource Name. Globally unique identifier for AWS resources in the format arn:partition:service:region:account-id:resource.
Worked samples
DuckDB 1.5.5 · finetype 0.6.64
| Value | As VARCHAR | account_id | partition | region | resource | service |
|---|---|---|---|---|---|---|
| arn:aws:s3:::my-bucket | arn:aws:s3:::my-bucket | aws | my-bucket | s3 | ||
| arn:aws:iam::123456789012:user/johndoe | arn:aws:iam::123456789012:user/johndoe | 123456789012 | aws | user/johndoe | iam | |
| arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0 | arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0 | 123456789012 | aws | us-east-1 | instance/i-1234567890abcdef0 | ec2 |
| arn:aws:lambda:eu-west-1:123456789012:function:my-function | arn:aws:lambda:eu-west-1:123456789012:function:my-function | 123456789012 | aws | eu-west-1 | function:my-function | lambda |
Shape
^arn:(aws|aws-cn|aws-us-gov):[a-zA-Z0-9\-]+:[a-z0-9\-]*:\d{0,12}:.+$| Value | Length | Shape |
|---|---|---|
| arn:aws:s3:::my-bucket | 22 | matches |
| arn:aws:iam::123456789012:user/johndoe | 38 | matches |
| arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0 | 63 | matches |
| arn:aws:lambda:eu-west-1:123456789012:function:my-function | 58 | matches |
| arn.aws:s3:::my-bucket | 22 | rejected: separator swapped |
Background
Origin
Amazon Resource Names (ARNs) are the identifiers Amazon Web Services uses to uniquely identify AWS resources.[1] AWS requires an ARN when a resource has to be specified unambiguously across all of AWS, such as in IAM policies, Amazon RDS tags and API calls.[1] AWS documents the general format as arn:partition:service:region:account-id:resource-id, with variants that write the last part as resource-type/resource-id or resource-type:resource-id.[1]
In AWS's definition, a partition is a group of AWS Regions, and each AWS account is scoped to one partition.[1] The IAM User Guide lists three supported partitions: aws for AWS Regions, aws-cn for China Regions and aws-us-gov for AWS GovCloud (US) Regions.[1] The service part of an ARN is the service namespace that identifies the AWS product.[1] The account part of an ARN is the ID of the AWS account that owns the resource, written without hyphens, as in 123456789012.[1] An AWS account ID is a 12-digit number, such as 012345678901, that uniquely identifies an AWS account.[2]
AWS notes that the ARNs for some resources omit the Region, the account ID, or both the Region and the account ID.[1] Amazon S3 gives the ARN of a bucket in the example format arn:aws:s3:::amzn-s3-demo-bucket.[3] AWS states that ARNs are not considered secret, sensitive, or confidential information, though like any identifying information they should be used and shared carefully.[1]
Use
In CloudTrail logs, the arn field of the userIdentity element holds the ARN of the principal that made the call.[4] CloudTrail's documentation shows a request made with an assumed role carrying an ARN such as arn:aws:sts::123456789012:assumed-role/RoleToBeAssumed/MySessionName.[4] CloudTrail's assumed-role example records the session issuer under the role's own ARN, arn:aws:iam::123456789012:role/RoleToBeAssumed.[4] When you join CloudTrail activity to an inventory of IAM roles, expect a session ARN and a role ARN for the same role, and decide which one your join key is before you count anything. (Meridian's view)
Amazon S3's documentation recommends, as a best practice, specifying the resource in a policy's Resource element by its ARN.[3]
Where you'll meet it
The Registry of Open Data on AWS lists the NOAA GOES satellite data by bucket ARNs such as arn:aws:s3:::noaa-goes19.[5] The Registry of Open Data's NOAA GOES page also gives SNS topic ARNs such as arn:aws:sns:us-east-1:123901341784:NewGOES19Object.[5]
Sources
- [1]Identify AWS resources with Amazon Resource Names (ARNs) - AWS Identity and Access Managementdocumentation
- [2]View AWS account identifiers - AWS Account Managementdocumentation
- [3]How Amazon S3 works with IAM - Amazon Simple Storage Servicedocumentation
- [4]CloudTrail userIdentity element - AWS CloudTraildocumentation
- [5]NOAA Geostationary Operational Environmental Satellites (GOES) 16, 17, 18 & 19 - Registry of Open Data on AWSdataset
Detection notes
Region and account-id may be empty for global resources (e.g., S3 buckets, IAM). Three partitions: aws, aws-cn, aws-us-gov.
Use it
$ finetype infer -i "arn:aws:s3:::my-bucket" --mode column
→ technology.cloud.aws_arn
SELECT ft_infer('arn:aws:s3:::my-bucket');
-- → 'technology.cloud.aws_arn'CAST({col} AS VARCHAR)Schema
https://meridian.online/schemas/technology.cloud.aws_arn · Frictionless type string
finetype taxonomy technology.cloud.aws_arn -o json-schema