AWS accounts with leading zeros can play havoc with your YAML, so use ARNs instead.