What Is an ARN? covers the format itself — partition, service, region, account ID, resource — and the handful of rules that make it more than a fill-in-the-blank template. This is the lookup companion: a real, correctly formatted example ARN for 23 of the most commonly referenced resource types, grouped by service, for whenever you just need to see the shape for one specific thing. Every example here matches what ARN Generator produces — same separators, same fields, verified the same way, against AWS's own documentation.
S3
| Resource | Example |
|---|
| Bucket | arn:aws:s3:::my-bucket |
| Object | arn:aws:s3:::my-bucket/path/to/file.txt |
No region, no account ID — bucket names are globally unique across all of AWS, so neither field is needed to identify one.
IAM
| Resource | Example |
|---|
| User | arn:aws:iam::123456789012:user/john |
| Role | arn:aws:iam::123456789012:role/my-role |
| Policy | arn:aws:iam::123456789012:policy/my-policy |
IAM is global — no region field — but the account ID is still required.
Lambda
| Resource | Example |
|---|
| Function | arn:aws:lambda:us-east-1:123456789012:function:my-function |
| Function version/alias | arn:aws:lambda:us-east-1:123456789012:function:my-function:1 |
A colon before the function name, not a slash — one of the more commonly mistyped ARNs on this whole page, since almost everything else after account ID uses a slash.
DynamoDB
| Resource | Example |
|---|
| Table | arn:aws:dynamodb:us-east-1:123456789012:table/my-table |
SNS and SQS
| Resource | Example |
|---|
| SNS topic | arn:aws:sns:us-east-1:123456789012:my-topic |
| SQS queue | arn:aws:sqs:us-east-1:123456789012:my-queue |
Both skip the resource-type prefix entirely — the name follows the account ID directly, unlike almost every other service on this page.
EC2
| Resource | Example |
|---|
| Instance | arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678 |
| VPC | arn:aws:ec2:us-east-1:123456789012:vpc/vpc-0e9801d129abcd123 |
| Security group | arn:aws:ec2:us-east-1:123456789012:security-group/sg-0abcd1234efgh5678 |
| EBS volume | arn:aws:ec2:us-east-1:123456789012:volume/vol-0abcd1234efgh5678 |
RDS
| Resource | Example |
|---|
| DB instance | arn:aws:rds:us-east-1:123456789012:db:my-mysql-instance-1 |
| DB cluster (Aurora) | arn:aws:rds:us-east-1:123456789012:cluster:my-aurora-cluster-1 |
RDS uses colons throughout — db for an instance, cluster for an Aurora cluster — where most other services would use a slash.
ECS
| Resource | Example |
|---|
| Cluster | arn:aws:ecs:us-east-1:123456789012:cluster/my-cluster |
| Task | arn:aws:ecs:us-east-1:123456789012:task/my-cluster/1abbb3b8-1234-4b3f-abcd-12345abcd123 |
The task ARN shown is the current long format, which includes the cluster name. Older tasks may still use a shorter format without it.
KMS
| Resource | Example |
|---|
| Key | arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab |
Secrets Manager
| Resource | Example |
|---|
| Secret | arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret-AbCdEf |
AWS always appends a hyphen plus 6 random characters to a real secret's name — a secret's actual ARN never ends exactly where you'd expect from the name alone.
CloudWatch Logs
| Resource | Example |
|---|
| Log group | arn:aws:logs:us-east-1:123456789012:log-group:/my-app/production |
Many CloudWatch Logs IAM actions expect a trailing :* on this ARN — add it yourself if the policy you're writing needs it.
Step Functions
| Resource | Example |
|---|
| State machine | arn:aws:states:us-east-1:123456789012:stateMachine:my-state-machine |
SSM
| Resource | Example |
|---|
| Parameter | arn:aws:ssm:us-east-1:123456789012:parameter/my-app/db-password |
CloudFormation
| Resource | Example |
|---|
| Stack | arn:aws:cloudformation:us-east-1:123456789012:stack/my-stack/51af3dc0-da77-11e4-872e-1234567db123 |
AWS assigns the trailing unique ID automatically when the stack is created — you won't know it in advance.
Try it yourself
ARN Generator covers all 23 resource types above (and a few more): pick one from a dropdown, fill in plain fields, and get back the exact ARN shown here with the account ID and identifiers swapped for your own. Already have an ARN and need to go the other way — break it into its individual fields, with warnings for a malformed account ID or an unrecognized partition — ARN Parser does that. Both run entirely in your browser.