AWS permission policies have actions and resources (and conditions, but let's leave those aside for the moment). For a given action, how can I get an accurate list of all the resources it can be applied to?

For example, if I have:

              "Action": [
              "Effect": "Allow",
              "Resource": "*"

the "*" refers to a set of resources. How can I find out which resources are in scope, and do so programmatically? I do not fancy repeating this manually for every one of the hundreds of actions in our policies.

An explicit list of ARNs is not needed, although that would be great as well. For s3:GetObject my purposes would be satisfied by arn:aws:s3:::*

Many thanks in advance.


  • So are you looking for a machine readable resource of the loosest or tightest valid resource ARNs that are available for each service/request combination? Many cli command work without specifying a resource, for example aws s3 ls, but could be applicable even to other accounts with cross account policies. So I guess I'm asking to clarify, do you want to approach this from the service side, ie. what resources can I run each command against, or from the security side, how can I make my policies as tight as possible? – jdog Jan 5 at 8:46
  • Both. I use "reachability" both for verifying that desired accesses are permitted before even deploying code, just by analysing the policies under source control, and for verifying that actors cannot "reach" resources that they should not be able to. – Max Murphy Jan 6 at 5:07
  • Ok, maybe your best option is to process your third bibliography link into a json file on github and share some basic tools to work with it, so that the maintenance work can be shared by contributors – jdog Jan 6 at 6:17
  • Alas the third bib link is an incomplete list. I have been searching for a more complete list. Also, that is only half the picture as it does not answer which actions can be applied to each type of ARN. First order approximation is to say that e.g. cloudformation:WhateverAction can apply only to arn:aws:cloudformation:* but that is of course too imprecise for anything that is to be relied upon. – Max Murphy Jan 6 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.