ARN Parser

An ARN packs five or six meaningful pieces of information into one colon-delimited string, and reading them off by eye gets error-prone the moment resources get nested — a Lambda alias, an IAM role under a path, an S3 object key with its own slashes. ARN Parser takes one ARN and splits it into its real fields: partition, service, region, account id, resource type, and resource id, laid out so you can see at a glance what you are actually looking at.

The split follows the same structure AWS itself uses: everything up to the fifth colon is the fixed header (arn:partition:service:region:account-id:), and everything after that is the resource. Because that resource segment is where AWS services diverge — some use type/id like an IAM role (role/my-role), some use type:id like a Lambda function version (function:my-func:3), and some are just a bare id like an SQS queue name — the parser looks for whichever separator appears first and splits there, falling back to treating the whole thing as a bare resource id when neither is present. That single rule correctly handles the overwhelming majority of ARNs you will paste in day to day: IAM roles and users, Lambda functions with versions or aliases, DynamoDB tables and their indexes, EC2 instances, KMS keys and aliases, SNS topics, SQS queues, and S3 buckets and objects.

Fields that AWS legitimately leaves blank are shown as blank rather than flagged as errors. S3 and IAM ARNs, for example, carry no region and (for S3) no account id between their colons — arn:aws:s3:::my-bucket is a completely valid ARN with two empty fields in the middle, and the parser reports those as empty strings so you can see the ARN really does look like that, instead of guessing something went wrong.

Parsing and validating are kept as two separate steps. Parsing only asks whether the string has the minimum shape of an ARN: it starts with arn: and has at least six colon-separated fields. If that much is true, you get a breakdown, even if the contents look unusual. Validation is a stricter check layered on top, run automatically alongside the parse: it flags a partition outside the three real AWS partitions (aws, aws-cn, aws-us-gov), an account id that is not empty and not exactly 12 digits, a region that does not match the shape of a real AWS region code, or a service field with characters outside lowercase letters, digits, and hyphens. Keeping the two separate means a slightly unusual but real ARN still gets parsed and shown, with the validation warnings sitting alongside it rather than blocking the result outright.

The result is shown as a labeled field list — not a raw JSON dump — so the account id, region, and resource id are each immediately identifiable, with a one-click Copy as JSON action for pasting the structured breakdown into a ticket, a script, or documentation. Malformed input produces a clear, specific parse error instead of a stack trace or a blank screen: too few colon-separated fields, a missing arn: prefix, or empty input are each called out by name.

This is a small, focused tool for a task that comes up constantly when working with AWS: someone pastes an ARN into a ticket, a CloudTrail event, or a policy document, and you need to know instantly which account it belongs to, which region, and what kind of resource it actually points to — without opening the AWS console or mentally counting colons. Everything happens in your browser; the ARN, which often contains a real AWS account id, is never sent anywhere.

• Full field breakdown — partition, service, region, account id, resource type, and resource id.
• Separator-aware resource splitting — correctly handles both type/id and type:id resource styles.
• Blank-field aware — S3/IAM-style ARNs with empty region or account are shown as empty, not flagged as broken.
• Inline validation — partition, account id, region, and service format are checked alongside the parse.
• Specific parse errors — names the exact problem (too few fields, wrong prefix, empty input) instead of failing silently.
• Multi-colon and multi-slash resource ids preserved intact — Lambda versions, S3 object paths.
• Copy as JSON for the full structured breakdown.
• Sample ARN and one-click clear.
• 100% client-side — nothing is uploaded, ever.

1. Paste an ARN into the input box, or click Load sample.
2. Click Parse (or just stop typing — it parses live).
3. Read the breakdown — partition, service, region, account, resource type, and resource id are listed individually.
4. Check the validation line — any format issues with the partition, account id, region, or service are listed underneath the breakdown.
5. Copy the result as JSON if you need it elsewhere.
6. Clear and try another ARN with one click.

Example 1 — IAM role with a path. arn:aws:iam::123456789012:role/service-role/my-lambda-role splits into service iam, account 123456789012, resource type role, and resource id service-role/my-lambda-role — the path stays attached to the id.

Example 2 — Lambda function alias. arn:aws:lambda:eu-west-1:123456789012:function:my-func:PROD gives resource type function and resource id my-func:PROD, keeping the alias suffix intact.

Example 3 — S3 object. arn:aws:s3:::my-bucket/logs/2026/08/20.log shows an empty region and account (both valid for S3), resource type my-bucket, and resource id logs/2026/08/20.log.

Example 4 — Malformed input. Pasting arn:aws:s3 returns a specific error: only 3 fields found, at least 6 required — no partial or misleading breakdown is shown.

Example 5 — Suspicious but parseable ARN. arn:aws:ec2:us-east-1:12345:instance/i-0abc123 still parses (6 fields, starts with arn:), but the validation line flags the account id 12345 as not being 12 digits.

• No more manual colon-counting — every field is labeled.
• Understands real-world resource formats, not just the textbook example.
• Distinguishes "malformed" from "unusual but valid" instead of over-flagging S3/IAM ARNs.
• Actionable errors when something really is broken.
• Copy-ready JSON output for tickets, scripts, and docs.
• Private — account IDs in your ARNs never leave the page.