I am creating an AWS IAM policy for a Serverless Framework project, I am applying the Principle of Least Privilege to ensure the policy is as tight as possible. To restrict the scope of the policy I need to be able to identify the ARN for each of the resources, i.e.:
Looking through the CloudWatch and CloudFormation UIs I can't actually see any mention of the resulting ARN for a created log group.
Question: For any resource within Amazon Web Services how can I obtain the ARN?