Introduction

You often need an EC2 instance ARN for IAM policies, CloudTrail analysis, tagging workflows, or audit reports. While the instance ID is easy to retrieve, the ARN is derived from account, region, and instance ID in a specific format. This guide shows both CLI and in-instance methods so you can generate ARNs reliably.

Understand EC2 ARN Format

An EC2 instance ARN follows this pattern:

arn:aws:ec2:region:account-id:instance/instance-id

Example:

arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123def4567890

The key fields are region, account ID, and instance ID.

Build ARN from AWS CLI Data

If you know the instance ID, fetch region and account data, then assemble the ARN.

1INSTANCE_ID="i-0abc123def4567890"
2REGION="us-east-1"
3ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
4
5echo "arn:aws:ec2:${REGION}:${ACCOUNT_ID}:instance/${INSTANCE_ID}"

You can also query instance metadata from EC2 describe calls when region is known.

aws ec2 describe-instances   --instance-ids "$INSTANCE_ID"   --region "$REGION"   --query 'Reservations[0].Instances[0].[InstanceId,Placement.AvailabilityZone]'   --output text

From availability zone, derive region by removing the trailing letter if needed.

Generate ARN from Inside the Instance

On an EC2 host, query IMDSv2 for instance ID and region, then construct ARN with account ID from STS.

1TOKEN=$(curl -sX PUT "http://169.254.169.254/latest/api/token"   -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
2
3INSTANCE_ID=$(curl -sH "X-aws-ec2-metadata-token: $TOKEN"   http://169.254.169.254/latest/meta-data/instance-id)
4REGION=$(curl -sH "X-aws-ec2-metadata-token: $TOKEN"   http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r '.region')
5ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
6
7echo "arn:aws:ec2:${REGION}:${ACCOUNT_ID}:instance/${INSTANCE_ID}"

This method is useful in bootstrap scripts and agent installations.

Use ARN in IAM Policy Conditions

Once generated, the ARN can be applied in policies and automation logic.

1{
2  "Version": "2012-10-17",
3  "Statement": [
4    {
5      "Effect": "Allow",
6      "Action": ["ec2:CreateTags"],
7      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123def4567890"
8    }
9  ]
10}

When scaling policies across many instances, prefer wildcard patterns with tag conditions rather than hard-coding one ARN per instance.

Validate ARN Consistency

Before shipping automation, validate each field:

• Account ID belongs to the expected AWS account
• Region matches the instance location
• Instance ID exists and has the expected format

A small preflight check prevents policy mis-scoping and cross-account errors.

Generate ARNs for Many Instances at Once

For audits, you often need ARNs for all running instances in a region. The CLI query output can be combined with account ID to produce a complete list quickly.

1REGION="us-east-1"
2ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
3
4aws ec2 describe-instances   --region "$REGION"   --filters Name=instance-state-name,Values=running   --query 'Reservations[].Instances[].InstanceId'   --output text | tr '	' '
5' | while read -r id; do
6    echo "arn:aws:ec2:${REGION}:${ACCOUNT_ID}:instance/${id}"
7  done

This output can be redirected into compliance tooling or IAM review scripts.

Cross-Account and Profile Awareness

In organizations with multiple AWS accounts, ARN generation scripts should always pin the profile and region explicitly. This prevents accidental mixing of account IDs in reports.

aws --profile prod sts get-caller-identity --query Account --output text
aws --profile prod ec2 describe-instances --region us-east-1 --max-items 5

Record the active profile name and account ID in script output so reviewers can verify scope immediately.

Common Pitfalls

• Assuming EC2 API responses always include a ready-to-use ARN field.
• Building ARN with the wrong account ID due to incorrect credentials profile.
• Confusing availability zone with region in script logic.
• Using IMDSv1 in hardened environments where only IMDSv2 is allowed.
• Hard-coding one ARN when a tag-based policy is more maintainable.

Summary

• EC2 ARN is deterministic from region, account ID, and instance ID.
• Use AWS CLI and STS to gather required fields safely.
• Inside EC2, IMDSv2 plus STS is a reliable generation method.
• Validate generated ARNs before applying IAM changes.
• Prefer scalable policy patterns when managing many instances.