More detail
For example arn:aws:dynamodb:us-east-1:111122223333:table/Todos reads as: partition, service, Region, account ID, then the resource. Policies use ARNs to say exactly which resource they cover.
ARN (Amazon Resource Name)
The unique full name of an AWS resource.
Think of it as: A full postal address, down to the flat number.
What to know for Level 0
- Read an ARN left to right:
arn:aws:<service>:<Region>:<account ID>:<resource>, for examplearn:aws:dynamodb:us-east-1:111122223333:table/Todos. - S3 bucket ARNs leave out the Region and the account, because bucket names are already unique across AWS:
arn:aws:s3:::todoio-pictures.