IAM ARN Format Reference

Writing the Resource element of an IAM policy statement means getting a service's specific ARN syntax exactly right — which segments are present, whether the resource id follows a slash or a colon, whether region and account id are even included. IAM ARN Format Reference is a searchable cheat sheet covering common AWS services' ARN patterns for exactly this purpose, each with its template, a realistic filled-in example, and a short note on that service's specific quirks.

Every ARN follows the same six colon-separated shape — arn:partition:service:region:account-id:resource — but what belongs in that last resource field, and how region/account-id are handled, varies service by service. S3 and IAM both drop fields that don't apply (no region for either, no account id for S3 buckets); RDS, Lambda, Step Functions, ElastiCache and CodePipeline use a colon to introduce the resource id where most other services use a slash; and a handful of global services like CloudFront and Route 53 leave region and, for some, account id empty entirely.

This is a curated selection covering roughly 30 services and resource types commonly referenced when writing IAM policies — not AWS's complete catalog of hundreds of services. AWS documents the authoritative, complete list in its own reference documentation, linked from the FAQ below.

• ~30 curated service/resource-type rows spanning storage, compute, database, messaging, and management services.
• Pattern, filled-in example, and quirk note for every row.
• Live search across service, resource type, pattern, example and note.
• One-click copy of any example ARN.
• 100% client-side — a static reference table, nothing sent anywhere.

1. Type a service name, resource type, or keyword into the search box (e.g. "lambda", "colon", "global").
2. Scan the matching rows for the ARN pattern and a realistic example.
3. Read the Note column for that service's quirks (missing fields, separator, suffixes).
4. Click the copy icon next to any example to copy it to your clipboard.

Example 1 — "does S3 include a region?" Search "s3" — the note makes clear S3 bucket ARNs omit both the region and account-id segments.

Example 2 — "which services use a colon instead of a slash?" Search "colon" to surface RDS, Lambda, Step Functions, ElastiCache, and CodePipeline.

Example 3 — writing a Resource for a specific Glue table. Search "glue" to find the table pattern arn:aws:glue:region:account-id:table/database-name/table-name.

• Saves time versus digging through per-service AWS docs for syntax used only occasionally.
• Surfaces the quirks that cause malformed ARNs — missing fields, wrong separator, unexpected suffixes.
• Pairs naturally with the ARN Parser and ARN Builder tools in this category.
• Honest about its limits — a curated subset, not a claim of completeness.