IAM resources requires region and account id?

Question

I tried simplifying my IAM policy https://github.com/kaihendry/terraform-aws-canary/blob/main/iam.tf#L39 from

"arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/cwsyn-*"

to

"arn:aws:logs:::log-group:/aws/lambda/cwsyn-*"

And now it doesn't work. Why?

Accepted Answer

ARN of CloudWatch Log Group requires region code and account id in the path. If you do not want to specify region code/account name in the path, you should try like below.

"arn:aws:logs:`*`:`*`:log-group:/aws/lambda/cwsyn-*"

Paths can include a wildcard character, namely an asterisk (*). Please refer to below link.

https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html

Answer

Please refer to the details on the resources ARN : https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html

`arn:partition:service:region:account-id:resource-id
arn:partition:service:region:account-id:resource-type/resource-id
arn:partition:service:region:account-id:resource-type:resource-id`

To look up the ARN format for a specific AWS resource, open the [Service Authorization Reference](https://docs.aws.amazon.com/service-authorization/latest/reference/), open the page for the service, and navigate to the resource types table.

Looks like for log group it is

```
arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}	
```

Note : You can specify IAM and AWS STS ARNs using the following syntax. The Region portion of the ARN is blank because IAM resources are global. Reference : https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html

```
arn:aws:iam::account:root  
arn:aws:iam::account:user/user-name-with-path
arn:aws:iam::account:group/group-name-with-path
arn:aws:iam::account:role/role-name-with-path
arn:aws:iam::account:policy/policy-name-with-path
arn:aws:iam::account:instance-profile/instance-profile-name-with-path
arn:aws:sts::account:federated-user/user-name
arn:aws:sts::account:assumed-role/role-name/role-session-name
arn:aws:iam::account:mfa/virtual-device-name-with-path
arn:aws:iam::account:u2f/u2f-token-id
arn:aws:iam::account:server-certificate/certificate-name-with-path
arn:aws:iam::account:saml-provider/provider-name
arn:aws:iam::account:oidc-provider/provider-name
```

IAM resources requires region and account id?

Relevant content