What is the actual structure of ECS Service ARNs? - amazon-web-services

Question

I'm trying to grant the ecs:UpdateService permission in an IAM policy like below:
{
"Sid": "AllowECS",
"Effect": "Allow",
"Action": [
"ecs:UpdateService"
],
"Resource": "arn:aws:ecs:ap-southeast-2:123456789012:service/my-service"
}
where the service ARN is as listed by the cli aws ecs list-services (and describe-services).
However the UpdateService API call fails with an AccessDenied error saying the process does not have permission to the service with ARN:
arn:aws:ecs:ap-southeast-2:123456789012:service/*my-cluster*/my-service
I cannot find any reference to the ARN for an ECS service including the the cluster name, and the documentation for the cli "ecs describe-services" explicitly says:
serviceArn -> (string)
The ARN that identifies the service. The ARN
contains the arn:aws:ecs namespace, followed by the Region of the
service, the AWS account ID of the service owner, the service
namespace, and then the service name. For example,
arn:aws:ecs:region:012345678910:service/my-service .
If I change the IAM policy to actually use the ARN shown in the error, which includes the cluster name, then the UpdateService completes successfully.
I'm not sure what I'm missing here, should an ECS service ARN include the cluster name? If so, how can I obtain that version of the ARN as the AWS APIs all seem to return the version that doesn't include the cluster name?

Answer 1

I had a similar issue lately as well.
Basically, there is a new ECS ARN as mentioned here. It's still under opt-in period till end of this year.
Please find below the old and new format comparison.
From your question, I think that your AWS account is also opted in for new format.
More details can be found FAQ