I am creating an AWS IAM policy for a Serverless Framework project, I am applying the Principle of Least Privilege to ensure the policy is as tight as possible. To restrict the scope of the policy I need to be able to identify the ARN for each of the resources, i.e.:
arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*
Looking through the CloudWatch and CloudFormation UIs I can't actually see any mention of the resulting ARN for a created log group.
Question: For any resource within Amazon Web Services how can I obtain the ARN?
arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*
... what they are trying to tell you is thatlog-group
is a fixed, literal string andmy-log-group
is the actual name of your log group... but it is not presented in a way that makes it obvious. Things that start withmy-
seem to be how they indicate the places where you would substitute the specific resource name. Is that what you're trying to figure out? Otherwise, your question contains a link to the answer, so it isn't clear what you're asking. – Michael - sqlbot May 21 '17 at 12:23HelloLogGroup
and a Physical ID of/aws/lambda/my-service-dev-hello
. Now I can just plug these on to the end of what I do know about the ARN and see if it works. I was hoping there was a more deterministic way of deriving the ARN for any given arbitray resource. – Richard Slater May 21 '17 at 16:26