01
Read the empty positions
Use the three examples to compare S3, IAM and Lambda. Empty fields are displayed explicitly. The service note explains common conventions without treating every unusual value as a structural error.
Cloud tools
AWS ARN parser
Inspect one ARN or a line-separated list, or assemble an ARN from five fields.
AWS ARN parser
ARN input
Fields and report
ARNs stay in this browser. No AWS request or credential is used.
Processing options
Maximum 200 nonempty lines and 128 KiB of UTF-8 input. Results appear 50 at a time.
Structure only: service hints do not confirm resource existence, complete service syntax or IAM access.
Input changed. Run again before exporting.
AWS ARN parser makes a pasted identifier easier to review before it enters configuration. A Lambda alias, an IAM path and an S3 object key share an outer shape, yet their resource tails behave differently.
Keep the original next to its fields when troubleshooting a copied value. A clean structural result is a starting point for checking the service documentation, not evidence that the named resource can be used.
Why use this AWS ARN parser
Keep the resource tail together
AWS ARN parser stops splitting after the fifth colon. An object key such as reports/quarter 1:final.csv retains its space and colon; a function version remains attached to the resource. You can inspect the boundaries without changing the identifier.
Build with deliberately empty fields
The ARN builder accepts the five outer fields directly. Leave region and account empty for an ordinary S3 bucket and the separators stay in place. No guessed resource type or extra slash is inserted.
Check boundaries before exporting
02
Choose when results refresh
Automatic processing waits 350 ms after an edit. Turn it off to run with Ctrl/Cmd + Enter. Changing a field or mode immediately disables old exports; switching modes preserves each set of inputs.
03
Inspect the batch totals
Compare parsed rows with errors. A mixed batch can be copied as a JSON report, but ARN text is available only when every row parses. Show more reveals another 50 rows; downloads always contain the full report.
What the workbench reads and produces
Five outer fields
The ARN format is decomposed into partition, service, region, account and resource. The fixed arn prefix is checked separately. Paths, case, Unicode and trailing spaces inside resource stay exactly as entered.
Batch diagnostics with source lines
Bulk ARN parsing preserves order and duplicate values. Blank lines are ignored while physical line numbers remain accurate. A malformed row stays in the report alongside successful rows instead of disappearing from the export.
Service notes with limited scope
S3, IAM and Lambda receive contextual notes. Account values such as aws are retained; unusual accounts and partition/region combinations prompt review. Unknown services still receive generic parsing without an invented validation badge.
Reversible input replacement
Loading an example or clearing input opens a preview with the before/after count. Apply changes only the active mode. Undo restores both that input and its corresponding result, including whether the result was already stale.
Boundaries that affect your result
- No existence or permission check
- The tool does not contact AWS, accept credentials, simulate IAM or validate a whole policy. A structurally parsed ARN may name a nonexistent resource or be unusable in the intended policy element.
- No universal resource-type guess
- Resource syntax varies by service. This tool keeps one complete resource field and provides limited notes rather than claiming to implement every service rule. S3 access point ARNs are not rejected merely for having region or account.
- Literal patterns, complete outer structure
- Wildcards and policy variables are retained without expansion. Incomplete forms such as arn:aws:sqs are not auto-completed. The tool cannot infer the policy context needed to decide what a pattern will match.
- A bounded line-based input
- Use at most 200 nonempty lines and 131,072 UTF-8 bytes. Newlines separate records; control characters within identifiers are unsupported here. This is an input limitation, not a claim that AWS forbids every such object key.
- No silent repair or extraction
- Leading spaces produce a prefix error; resource spaces are preserved. There is no URL decoding, path cleanup, deduplication, automatic /* suffix, file import or policy-JSON extraction. Paste literal ARNs and review errors explicitly.
AWS ARN parser questions
Why can ARN region and account fields be blank?
Services define which fields are required. Ordinary S3 bucket and object ARNs leave both blank, while IAM usually leaves region blank. Other S3 resource types may include them, so use the exact service resource reference.
How do colon and slash resource separators differ?
They belong to the service-specific resource syntax. IAM paths commonly use slashes, while Lambda qualifiers use colons. This tool preserves the entire resource tail instead of trying to apply one split rule to every service.
Are wildcards allowed inside an ARN?
Some policy contexts allow * and ? in parts of an ARN; the permitted positions depend on the service and policy element. The report flags possible patterns and keeps them literal. It neither expands matches nor approves the policy.
Where can I look up a resource ARN?
Look in the resource details in the AWS console or use the relevant service API or CLI response. The AWS Service Authorization Reference describes the format. This workbench does not discover resources or retrieve ARNs from an account.
Does parsing prove an AWS resource exists?
No. Parsing only identifies the outer structure and produces review notes. Existence and access depend on live AWS state and permissions, which this tool does not query. Verify those separately in the intended environment.
Still have a question?
Inspect the next identifier
Use AWS ARN parser to compare the literal identifier with its fields, then carry a complete report into your configuration review.