What this tool does
Pick a resource type — an S3 bucket, a Lambda function, an IAM role, one of 23 common AWS resources — fill in the plain fields, and get back a correctly formatted ARN. The general shape (arn:partition:service:region:account-id:resource) is the easy part; what actually trips people up is that the resource portion's separator genuinely varies by service — some use a slash (table/my-table), some use a colon (function:my-function), and some use neither (an SNS topic name follows the account ID directly, with nothing in between). This tool encodes the correct separator for each resource type per AWS's own ARN reference and each service's own documentation, so you don't have to remember which is which.
Fields that disappear depending on the resource type
Region and account ID aren't universal. S3 bucket and object ARNs have neither — a bucket name is globally unique on its own. IAM resources (users, roles, policies) are global, so their ARNs have no region field, but still need the account ID. Selecting a resource type disables whichever fields that type doesn't use, instead of leaving them there to be filled in by mistake.
A few of these are worth knowing about in advance
- Secrets Manager appends a hyphen plus 6 random characters to a secret's name the moment it's actually created — this tool can't predict that suffix, so an ARN built without it is only the part you control.
- CloudFormation stacks get a unique ID from AWS at creation time too, appended after the stack name — leave it blank if you're constructing an ARN before the stack exists.
- Lambda functions use a colon before the function name, not a slash — one of the most common ARNs to get subtly wrong by pattern-matching from a different service.
FAQ
Does this check that the resource actually exists?
No — this only builds a correctly shaped ARN from the fields you enter; it never makes an AWS API call or needs credentials, and nothing you type leaves your browser. It can't know whether an account ID, bucket, or function name is real.
I have an ARN already and need to break it apart, not build one
That's the reverse tool: ARN Parser splits an existing ARN into its partition, service, region, account ID, and resource fields, with warnings for anything that looks malformed.
I just want to see an example, not fill in a form
AWS ARN Examples lists a correctly formatted example for every resource type this tool covers, grouped by service — a quick reference instead of a form.
My service isn't in the list
This covers 23 of the most commonly referenced resource types across S3, IAM, Lambda, DynamoDB, SNS, SQS, EC2, RDS, ECS, KMS, Secrets Manager, CloudWatch Logs, Step Functions, SSM, and CloudFormation — not every AWS service. For anything else, the general pattern above still applies; the Service Authorization Reference has the exact resource-type table for every AWS service.
What's the difference between this and IAM Policy Generator?
IAM Policy Generator builds a full policy statement — effect, actions, resources, conditions — and expects you to already have the ARNs to put in its Resources field. This tool is what fills that field in correctly in the first place.