6

I am creating an AWS IAM policy for a Serverless Framework project, I am applying the Principle of Least Privilege to ensure the policy is as tight as possible. To restrict the scope of the policy I need to be able to identify the ARN for each of the resources, i.e.:

arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*

Looking through the CloudWatch and CloudFormation UIs I can't actually see any mention of the resulting ARN for a created log group.

Question: For any resource within Amazon Web Services how can I obtain the ARN?

|improve this question
  • 1
    In arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*... what they are trying to tell you is that log-group is a fixed, literal string and my-log-group is the actual name of your log group... but it is not presented in a way that makes it obvious. Things that start with my- seem to be how they indicate the places where you would substitute the specific resource name. Is that what you're trying to figure out? Otherwise, your question contains a link to the answer, so it isn't clear what you're asking. – Michael - sqlbot May 21 '17 at 12:23
  • @Michael-sqlbot I had assumed as much, specific to log groups, however, there appear to be two names if I were to create a log group for Lambda it would end up with a Logical ID of HelloLogGroup and a Physical ID of /aws/lambda/my-service-dev-hello. Now I can just plug these on to the end of what I do know about the ARN and see if it works. I was hoping there was a more deterministic way of deriving the ARN for any given arbitray resource. – Richard Slater May 21 '17 at 16:26
5

https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html lists the schema for (I believe) all of the ARNs that Amazon supports. Text in italic red indicates where you should substitute in your own value, rather than the literal string, and there are examples in each section to help figure this out.

Be warned that IAM is less usefully restrictive than it appears on first glance. To start with, most services have only partial IAM support. Secondly, often the things that are supported at a resource level are supported only in very specific ways; for instance, granting all permissions on a subnet ARN does not grant the attached users the ability to fully manage instances in that subnet, as AttachVolume only supports restricting by volume id, etc. Thirdly, if the users are going to use the Amazon web console at all, they must have broad viewing permissions, as the console was not written with PoLP in mind and issues non-resource-restricted API calls (and often merely dumps errors in the javascript console!).

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.