ARN Parser

What this tool does

An Amazon Resource Name (ARN) uniquely identifies a specific AWS resource — the exact string an IAM policy's Resource element, an API call, or a CloudFormation template references. Paste one in and this tool splits it into its six fields per AWS's own ARN format, and flags anything that looks off — a malformed account ID, an unrecognized partition, a wildcard.

The general format

arn:partition:service:region:account-id:resource-id
arn:partition:service:region:account-id:resource-type/resource-id
arn:partition:service:region:account-id:resource-type:resource-id

Everything after the fifth colon is the resource part, and it isn't always simple — some services (Lambda's versioned function ARNs, for instance) pack a third piece after another colon: resource-type:resource-id:qualifier. This tool handles all three shapes, plus S3-style paths with multiple slashes.

Fields that are allowed to be empty

region and account-id aren't always present. IAM resources are global, so their ARNs have no region. S3 bucket ARNs have neither — a bucket name is globally unique on its own, so AWS doesn't need either field to identify it. An empty field here isn't necessarily a mistake; this tool only warns when a field is empty for a service where that would be unusual.

FAQ

I need to build an ARN, not break one apart

That's the reverse tool: ARN Generator picks a resource type — S3 bucket, Lambda function, IAM role, and 20 others — and builds a correctly formatted ARN from plain fields, using the right separator for each service instead of making you guess. Or see AWS ARN Examples for a quick reference instead of a form.

Why does my account ID show a warning even though the ARN looks right?

A standard AWS account ID is exactly 12 digits, no hyphens. If it isn't — too short, contains letters, whatever — that's flagged, since it's a common copy-paste mistake (grabbing a truncated ID from a table, or accidentally including hyphens some UIs display for readability).

Does this validate that the resource actually exists?

No — this is a pure string parser with no AWS credentials or API calls involved; nothing you paste here ever leaves your browser. It checks the ARN's shape, not whether the account, region, or resource are real. For checking permissions against a real policy, see IAM Policy Viewer.

What does the wildcard warning mean?

A * or ? anywhere in the ARN means it matches a set of resources rather than one specific one — common and valid inside an IAM policy's Resource element, but worth noticing if you expected an ARN for a single, specific resource.

I need to parse ARNs in my own code, not just here — where do I start?

See How to Parse an ARN (JavaScript), How to Parse an ARN in Python, How to Parse an ARN in Go, How to Parse an ARN in Java, or How to Parse an ARN in C# — all five cover the exact bug a naive split(":") or regex hits on an ARN whose resource part contains colons, like Lambda's versioned function ARNs. For what each field actually means, see What Is an ARN?