Examples:
Decode AWS ARNs into their components
Paste any Amazon Resource Name and instantly see its partition, service, region, account ID, and resource path broken out. Useful for debugging IAM policies, CloudFormation templates, and cross-account access issues.
Frequently Asked Questions
- What is an AWS ARN?
- An Amazon Resource Name (ARN) uniquely identifies an AWS resource. It follows the pattern arn:partition:service:region:account-id:resource, for example arn:aws:s3:::my-bucket.
- Why is the region or account ID sometimes empty in an ARN?
- Global services like S3 and IAM omit the region (and sometimes the account) because their resource names are globally unique. Empty segments between colons are valid.
- Is my ARN sent to a server?
- No. The ARN is parsed entirely in your browser, so it is safe to paste ARNs that contain real account IDs.
- How do wildcards work in ARNs?
- In IAM policies, * and ? can appear in the resource segment to match multiple resources, e.g. arn:aws:s3:::my-bucket/* matches every object in the bucket.