How to get the ARN for an arbitrary Amazon Resource?
https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html lists the schema for (I believe) all of the ARNs that Amazon supports.  Text in italic red indicates where you should substitute in your own value, rather than the literal string, and there are examples in each section to help figure this out.

Be warned that IAM is less usefully restrictive than it appears on first glance.  To start with, most services have only partial IAM support.  Secondly, often the things that are supported at a resource level are supported only in very specific ways; for instance, granting all permissions on a subnet ARN does not grant the attached users the ability to fully manage instances in that subnet, as AttachVolume only supports restricting by volume id, etc.  Thirdly, if the users are going to use the Amazon web console at all, they must have broad viewing permissions, as the console was not written with PoLP in mind and issues non-resource-restricted API calls (and often merely dumps errors in the javascript console!).