Cloud & Platform

AWS ARN Parser

Splits ARNs into their six fields and flags the ones that will silently match nothing.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste one ARN per line. A whole policy document will not parse — copy just the resource values out of it.
  2. Select Parse ARNs.
  3. Read the summary before the table. That is where a region or account field that should be empty is called out.
  4. For a policy that is not matching, compare the resource column against the ARN the service actually reports for the resource.

What aws arn parser does

Splitting an ARN on colons is not the hard part. The hard part is that some services carry a region and an account in those fields and some deliberately do not, and an ARN that fills in a field which should be empty is not rejected — it is simply a pattern that matches nothing, which is a much worse failure than an error because the policy appears to be in place.

S3 bucket ARNs carry neither a region nor an account. IAM, STS, CloudFront and Route 53 carry an account but no region. Everything else carries both. Every ARN pasted here is split into its fields and checked against those rules, with wildcards called out as policy patterns rather than resources. It is pure string analysis in your browser: nothing is sent to AWS and no resource is checked for existence.

Frequently asked questions

Because S3 bucket names are globally unique, so neither field is needed to identify the resource and both are required to be empty. An ARN such as arn:aws:s3:us-east-1:123456789012:my-bucket looks reasonable and matches nothing. This is the single most common reason a hand-written bucket policy appears to be in place and is not.

It separates AWS into isolated worlds. Commercial AWS is aws, China is aws-cn, GovCloud is aws-us-gov, and the classified regions have their own. Resources cannot be referenced across a partition boundary, so an ARN copied from a commercial account will never match in GovCloud even if everything after the partition is identical.

Because AWS never standardised it. IAM uses a slash for the resource type, as in role/DataEngineer; Lambda uses a colon, as in function:etl-loader; some services support both and treat them differently in wildcard matching. This tool reports the resource portion verbatim rather than guessing at the separator, since the exact string is what a policy compares against.

No. Nothing here contacts AWS at all — it is string analysis running in your browser. A perfectly valid ARN for a bucket that was deleted last year parses exactly like one for a bucket that exists. That also means it is safe to paste account numbers here, since they go nowhere.