ARN Parser

What this tool does

An Amazon Resource Name (ARN) uniquely identifies a specific AWS resource — the exact string an IAM policy's Resource element, an API call, or a CloudFormation template references. Paste one in and this tool splits it into its six fields per AWS's own ARN format, and flags anything that looks off — a malformed account ID, an unrecognized partition, a wildcard.

The general format

arn:partition:service:region:account-id:resource-id
arn:partition:service:region:account-id:resource-type/resource-id
arn:partition:service:region:account-id:resource-type:resource-id

Everything after the fifth colon is the resource part, and it isn't always simple — some services (Lambda's versioned function ARNs, for instance) pack a third piece after another colon: resource-type:resource-id:qualifier. This tool handles all three shapes, plus S3-style paths with multiple slashes.

Fields that are allowed to be empty

region and account-id aren't always present. IAM resources are global, so their ARNs have no region. S3 bucket ARNs have neither — a bucket name is globally unique on its own, so AWS doesn't need either field to identify it. An empty field here isn't necessarily a mistake; this tool only warns when a field is empty for a service where that would be unusual.

FAQ

Why does my account ID show a warning even though the ARN looks right?

A standard AWS account ID is exactly 12 digits, no hyphens. If it isn't — too short, contains letters, whatever — that's flagged, since it's a common copy-paste mistake (grabbing a truncated ID from a table, or accidentally including hyphens some UIs display for readability).

Does this validate that the resource actually exists?

No — this is a pure string parser with no AWS credentials or API calls involved; nothing you paste here ever leaves your browser. It checks the ARN's shape, not whether the account, region, or resource are real. For checking permissions against a real policy, see IAM Policy Viewer.

What does the wildcard warning mean?

A * or ? anywhere in the ARN means it matches a set of resources rather than one specific one — common and valid inside an IAM policy's Resource element, but worth noticing if you expected an ARN for a single, specific resource.

I need to parse ARNs in my own code, not just here — where do I start?

See How to Parse an ARN (JavaScript), How to Parse an ARN in Python, How to Parse an ARN in Go, or How to Parse an ARN in Java — all four cover the exact bug a naive split(":") or regex hits on an ARN whose resource part contains colons, like Lambda's versioned function ARNs. For what each field actually means, see What Is an ARN?