Amazon Elastic Compute Cloud

User Guide for Linux Instances

AWS Documentation » Amazon EC2 » User Guide for Linux Instances » Resources and Tags » Resource IDs

Resource IDs

When resources are created, we assign each resource a unique resource ID. You can use resource IDs to find your resources in the Amazon EC2 console. If you are using a command line tool or the Amazon EC2 API to work with Amazon EC2, resource IDs are required for certain commands. For example, if you are using the stop-instances AWS CLI command to stop an instance, you must specify the instance ID in the command.

Resource ID Length

A resource ID takes the form of a resource identifier (such as snap for a snapshot) followed by a hyphen and a unique combination of letters and numbers. Starting in January 2016, we're gradually introducing longer length IDs for Amazon EC2 and Amazon EBS resource types. The length of the alphanumeric character combination was in an 8-character format; the new IDs are in a 17-character format, for example, i-1234567890abcdef0 for an instance ID.

Supported resource types have an opt-in period, during which you can choose a resource ID format, and a deadline date, after which the resource defaults to the longer ID format. After the deadline has passed for a specific resource type, you can no longer disable the longer ID format for that resource type.

Different resource types have different opt-in periods and deadline dates. The following table lists the supported resource types, along with their opt-in periods and deadline dates.

During the Opt-in Period

You can enable or disable longer IDs for a resource at any time during the opt-in period. After you've enabled longer IDs for a resource type, any new resources that you create are created with a longer ID.

Depending on when you created your AWS account, supported resource types may default to using longer IDs. However, you can opt out of using longer IDs until the deadline date for that resource type. For more information, see Longer EC2 and EBS Resource IDs in the Amazon EC2 FAQs.

After the Deadline Date

You can’t disable longer IDs for a resource type after its deadline date has passed. Any new resources that you create are created with a longer ID.

Working with Longer IDs

You can enable or disable longer IDs per IAM user and IAM role. By default, an IAM user or role defaults to the same settings as the root user.

Viewing Longer ID Settings

You can use the console and command line tools to view the resource types that support longer IDs.

To view your longer ID settings using the console

1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

2. In the navigation bar at the top of the screen, select the region for which to view your longer ID settings.

3. From the dashboard, under Account Attributes, choose Resource ID length management.

4. Expand Advanced Resource ID Management to view the resource types that support longer IDs and their deadline dates.

To view the aggregated longer ID settings for a specific region using the command line

Use the describe-aggregate-id-format AWS CLI command to view the aggregated longer ID setting for the entire region, as well as the aggregated longer ID setting of all ARNs for each resource type. This command is useful for performing a quick audit to determine whether a specific region is fully opted in for longer IDs.

aws ec2 describe-aggregate-id-format --region region

To identify users who have explicitly defined custom longer ID settings

Use the describe-principal-id-format AWS CLI command to view the longer ID format settings for the root user and all IAM roles and IAM users that have explicitly specified a longer ID preference. This command is useful for identifying IAM users and IAM roles that have overridden the default longer ID settings.

aws ec2 describe-principal-id-format --region region

Modifying Longer ID Settings

You can use the console and command line tools to modify longer ID settings for resource types that are still within their opt-in period.

To modify longer ID settings using the console

1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

2. In the navigation bar at the top of the screen, select the region for which to modify the longer ID settings.

3. From the dashboard, under Account Attributes, choose Resource ID length management.

4. Do one of the following:

   • To enable longer IDs for all supported resource types for all IAM users across all regions, choose Switch to longer IDs, Yes, switch to longer IDs.

     Important

     IAM users and IAM roles need the ec2:ModifyIdentityIdFormat permission to perform this action.

   • To modify longer ID settings for a specific resource type for your IAM user account, expand Advanced Resource ID Management, and then select the corresponding check box in the My IAM Role/User column to enable longer IDs, or clear the check box to disable longer IDs.

   • To modify longer ID settings for a specific resource type for all IAM users, expand Advanced Resource ID Management, and then select the corresponding check box in the All IAM Roles/Users column to enable longer IDs, or clear the check box to disable longer IDs.

Controlling Access to Longer ID Settings

By default, IAM users and roles do not have permission to use the following actions unless they're explicitly granted permission through their associated IAM policies:

For example, an IAM role may have permission to use all Amazon EC2 actions through an "Action": "ec2:*" element in the policy statement.

To prevent IAM users and roles from viewing or modifying the longer resource ID settings for themselves or other users and roles in your account, ensure that the IAM policy contains the following statement:

{
  "Version": "2012-10-17", 
  "Statement": [ 
    { 
      "Effect": "Deny",
      "Action": [
        "ec2:ModifyIdFormat", 
        "ec2:DescribeIdFormat", 
        "ec2:ModifyIdentityIdFormat", 
        "ec2:DescribeIdentityIdFormat",
        "ec2:DescribeAggregateIdFormat",
        "ec2:DescribePrincipalIdFormat"
      ],
      "Resource": "*"
    }
  ] 
}   

We do not support resource-level permissions for the following actions:

On this page:

• Working with Longer IDs
• Controlling Access to Longer ID Settings