# AWS ARN Key: `technology.cloud.aws_arn` Amazon Resource Name. Globally unique identifier for AWS resources in the format arn:partition:service:region:account-id:resource. Page: Samples: `arn:aws:s3:::my-bucket`, `arn:aws:iam::123456789012:user/johndoe`, `arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0`, `arn:aws:lambda:eu-west-1:123456789012:function:my-function` ## Background ### Origin Amazon Resource Names (ARNs) are the identifiers Amazon Web Services uses to uniquely identify AWS resources.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) AWS requires an ARN when a resource has to be specified unambiguously across all of AWS, such as in IAM policies, Amazon RDS tags and API calls.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) AWS documents the general format as arn:partition:service:region:account-id:resource-id, with variants that write the last part as resource-type/resource-id or resource-type:resource-id.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) In AWS's definition, a partition is a group of AWS Regions, and each AWS account is scoped to one partition.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) The IAM User Guide lists three supported partitions: aws for AWS Regions, aws-cn for China Regions and aws-us-gov for AWS GovCloud (US) Regions.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) The service part of an ARN is the service namespace that identifies the AWS product.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) The account part of an ARN is the ID of the AWS account that owns the resource, written without hyphens, as in 123456789012.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) An AWS account ID is a 12-digit number, such as 012345678901, that uniquely identifies an AWS account.[[2]](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html) AWS notes that the ARNs for some resources omit the Region, the account ID, or both the Region and the account ID.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) Amazon S3 gives the ARN of a bucket in the example format arn:aws:s3:::amzn-s3-demo-bucket.[[3]](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html) AWS states that ARNs are not considered secret, sensitive, or confidential information, though like any identifying information they should be used and shared carefully.[[1]](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) ### Use In CloudTrail logs, the arn field of the userIdentity element holds the ARN of the principal that made the call.[[4]](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) CloudTrail's documentation shows a request made with an assumed role carrying an ARN such as arn:aws:sts::123456789012:assumed-role/RoleToBeAssumed/MySessionName.[[4]](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) CloudTrail's assumed-role example records the session issuer under the role's own ARN, arn:aws:iam::123456789012:role/RoleToBeAssumed.[[4]](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) When you join CloudTrail activity to an inventory of IAM roles, expect a session ARN and a role ARN for the same role, and decide which one your join key is before you count anything. (Meridian's view) Amazon S3's documentation recommends, as a best practice, specifying the resource in a policy's Resource element by its ARN.[[3]](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html) ### Where you'll meet it The Registry of Open Data on AWS lists the NOAA GOES satellite data by bucket ARNs such as arn:aws:s3:::noaa-goes19.[[5]](https://registry.opendata.aws/noaa-goes/) The Registry of Open Data's NOAA GOES page also gives SNS topic ARNs such as arn:aws:sns:us-east-1:123901341784:NewGOES19Object.[[5]](https://registry.opendata.aws/noaa-goes/) ## Sources 1. [Identify AWS resources with Amazon Resource Names (ARNs) - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) — documentation 2. [View AWS account identifiers - AWS Account Management](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html) — documentation 3. [How Amazon S3 works with IAM - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html) — documentation 4. [CloudTrail userIdentity element - AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html) — documentation 5. [NOAA Geostationary Operational Environmental Satellites (GOES) 16, 17, 18 \& 19 - Registry of Open Data on AWS](https://registry.opendata.aws/noaa-goes/) — dataset