An ARN can be subtly wrong in ways that are easy to miss by eye: an account id with the wrong digit count, a region typed without its dashes, a partition misspelled as awz, a service field with an uppercase letter that snuck in from a copy-paste. ARN Validator runs a fixed set of format checks against a single ARN and reports exactly which ones pass and which fail, by name, instead of leaving you to eyeball a long colon-delimited string.
The checks run in two layers. The first is structural: does the string even have the shape of an ARN — does it start with the literal arn:, and does it have at least six colon-separated fields (partition, service, region, account, and a resource that may itself contain more colons)? If that much fails, validation stops there with a specific error, because nothing past that point can be meaningfully checked. If the basic shape holds, four further format checks run against the individual fields: the partition must be one of the three real AWS partitions (aws, aws-cn, or aws-us-gov) rather than a typo; the account id, if present, must be exactly twelve digits, since a shorter or longer number is never a real AWS account id; the region, if present, must match the general shape AWS region codes follow (two letters, an optional -gov, a hyphenated location name, and a trailing digit — us-east-1, ap-southeast-2, us-gov-west-1); and the service field must be lowercase letters, digits, and hyphens only, since AWS service identifiers in ARNs are always lowercase.
Two fields are deliberately allowed to be empty without being flagged: region and account. That is not a gap in the checks — it reflects real AWS behavior. S3 bucket ARNs and IAM ARNs both omit the region field entirely, and S3 additionally omits the account field, producing ARNs like arn:aws:s3:::my-bucket with two empty fields in a row. A validator that flagged those as errors would be wrong about how AWS ARNs actually work, so this one only flags a region or account that is present but malformed, never one that is simply absent where AWS allows it to be.
Every check that fails is reported individually and by name, not just as a single pass/fail bit — so a single result might read "account id '12345' must be empty or exactly 12 digits" while the region and service checks pass cleanly, telling you precisely what to fix rather than making you guess which of five possible things went wrong. When every check passes, the tool also shows the parsed field breakdown underneath, since a validator that only says "valid" without showing what it validated is harder to trust at a glance.
What this tool cannot tell you is whether the resource named by the ARN actually exists, whether you have permission to access it, or whether the account id belongs to a real AWS account — none of that is checkable without calling AWS, and this tool never does. It is a pure, local format check: useful for catching a mistyped ARN before it goes into a policy document, a CLI command, or a support ticket, with the ARN itself — which often contains a real account id — never leaving your browser.