AWS ARN Parser
Parse AWS ARNs into partition, service, region, account, and resource parts with copyable segments, and build valid ARNs back from components.
Loading tool...
What is AWS ARN Parser?
An AWS ARN parser that splits Amazon Resource Names into partition, service, region, account ID, and resource segments, and assembles valid ARNs back from components — all in your browser.
Key Benefits
- Understand unfamiliar ARNs from logs, policies, and error messages in seconds
- Extract account IDs and resource IDs without manual colon counting
- Assemble correctly formatted ARNs for IAM policies and IaC templates
- Private and offline — nothing is uploaded
Common Use Cases
- •Debugging IAM policy mismatches by comparing resource segments
- •Extracting account IDs from CloudTrail logs or cross-account role ARNs
- •Building resource ARNs for Terraform, CloudFormation, or CDK templates
- •Reviewing ARNs in security audits without pasting them into external sites
How to Use the AWS ARN Parser
- Paste the ARN: Copy an ARN from the AWS Console, CloudTrail logs, or an IAM policy and paste it into the input field.
- Review the parsed segments: The tool splits the ARN into partition, service, region, account ID, and resource, and highlights the resource type and ID.
- Copy the parts you need: Click the copy button next to any segment to grab just that part, such as the account ID or resource ID.
- Build ARNs from components: Switch to the Build tab, fill in partition, service, region, account, and resource, then copy the validated ARN.
Key Features
- Parse ARNs into partition, service, region, account ID, and resource segments
- Build valid ARNs back from components with live validation
- Split resource part into type and ID, including nested paths and colon ids
- Copyable segments with one click, plus copy the full ARN
- Load example ARNs for S3, IAM, Lambda, EC2, and DynamoDB
Frequently Asked Questions
What are the parts of an AWS ARN?
An ARN has the form arn:partition:service:region:account-id:resource. The partition is aws, aws-cn, or aws-us-gov; the service is like s3 or iam; region and account can be blank for global services; the resource part varies per service.
Why do some ARNs have empty region or account fields?
Global services such as IAM and S3 do not use a region, so the field is blank. S3 bucket ARNs also leave the account ID empty because the bucket name is globally unique.
Is my ARN sent to any server?
No. Parsing happens entirely in your browser with plain string operations, so ARNs containing account IDs or resource names never leave your machine.
Can this tool build ARNs too?
Yes. Switch to the Build tab, fill in partition, service, region, account ID, and resource, and the tool assembles a validated ARN that you can copy into IAM policies or infrastructure code.