Serverless Developer Guide
arn:partition:service:region:account-id:resource-type/resource-id
arn:partition:service:region:account-id:resource-type:resource-id
• arn means this string is an ARN
• partition is one of the three AWS partitions: AWS regions, AWS China regions, or AWS 
GovCloud (US) regions
• service is the speciﬁc AWS service, for example: EC2
• region is the AWS region, for example: us-east-1 (North Virginia)
• account-id is the AWS account ID
• resource-id is the unique resource ID. (Could also be in the form resource-type/
resource-id)
Related resource(s):
• IAM identiﬁers provides an exhaustive list in the docs for IAM ARNs
Conditions
Conditions are speciﬁc rules for which the access is valid.
Other Elements
• All IAM policies have an Eﬀect ﬁeld which is set to either Allow or Deny.
• Version ﬁeld deﬁnes which IAM service API version to use when evaluating the policy.
• Statement ﬁeld consists of one or many JSON objects that contain the speciﬁc Action, Eﬀect, 
Resource, and Condition ﬁelds described previously
• Sid (statement ID) is an optional identiﬁer for a policy statement; some services like Amazon 
Simple Queue Service and Amazon Simple Notiﬁcation Service might require this element and 
have uniqueness requirements for it
Policies
When you set permissions, you attach a JSON policy to a principal. In the following example, an 
AWS managed policy named AWSLambdaInvocation-DynamoDB will be attached to a role that is 
related to a Lambda function:
Fundamentals 41