What is the actual structure of ECS Service ARNs?

I'm trying to grant the ecs:UpdateService permission in an IAM policy like below:

{
            "Sid": "AllowECS",
            "Effect": "Allow",
            "Action": [
              "ecs:UpdateService"
            ],
            "Resource": "arn:aws:ecs:ap-southeast-2:123456789012:service/my-service"
        }  

where the service ARN is as listed by the cli aws ecs list-services (and describe-services).

However the UpdateService API call fails with an AccessDenied error saying the process does not have permission to the service with ARN:

arn:aws:ecs:ap-southeast-2:123456789012:service/*my-cluster*/my-service

I cannot find any reference to the ARN for an ECS service including the the cluster name, and the documentation for the cli "ecs describe-services" explicitly says:

serviceArn -> (string)
The ARN that identifies the service. The ARN contains the arn:aws:ecs namespace, followed by the Region of the service, the AWS account ID of the service owner, the service namespace, and then the service name. For example, arn:aws:ecs:region:012345678910:service/my-service .

If I change the IAM policy to actually use the ARN shown in the error, which includes the cluster name, then the UpdateService completes successfully.

I'm not sure what I'm missing here, should an ECS service ARN include the cluster name? If so, how can I obtain that version of the ARN as the AWS APIs all seem to return the version that doesn't include the cluster name?