An EC2 instance ARN is one of the more straightforward shapes in this tool family once you have all four pieces in hand: region, account id, the literal instance resource type, and the instance id itself, joined as arn:aws:ec2:region:account:instance/instance-id. The part that actually causes mistakes is the instance id — copy-pasting from a console tab, a CloudTrail event, or a ticket, it is easy to grab a truncated or mistyped id without noticing. EC2 Instance ARN Generator assembles the ARN from separate region, account, and instance id fields, and checks the instance id against the shape AWS actually issues, flagging anything that looks off without blocking you from proceeding.
EC2 instances are both regional and account-scoped, so — unlike S3 or IAM — this form requires both a region and a 12-digit account id, along with the instance id. Get any one of the three wrong and you have an ARN pointing at something that doesn’t exist, so all three are treated as required fields with the same missing-field error style used across this tool family.
Instance ids have changed shape once in AWS’s history: modern instance ids are i- followed by 17 lowercase hexadecimal characters (i-0abc123def4567890), while older AWS accounts may still reference instances created before that lengthening, using the original 8-character form (i-0abc1234). Both are recognized by the format check here. That check runs as a soft warning rather than a hard block: it flags an id that doesn’t start with i- followed by hex characters, but still lets you build and copy the ARN, since you might be filling in a template placeholder, working against a historical or non-standard id, or testing a policy pattern rather than referencing a live instance — none of which the tool can distinguish from a genuine typo, so it surfaces the concern and lets you decide.
The tool is intentionally scoped to just the instance ARN shape rather than trying to cover every EC2 resource type. Security groups, volumes, network interfaces, snapshots, and AMIs all use a similar type/id resource pattern under the same ec2 service — security-group/sg-..., volume/vol-..., and so on — but each has its own id prefix and semantics, and mixing them into one form would blur what’s meant to be a fast, single-purpose tool for the by far most common case: referencing a specific EC2 instance in an IAM policy, a resource-based condition, or a CloudFormation parameter.
Once region, account, and instance id are filled in, a live preview shows the ARN updating as you type. Clicking Build runs the finished ARN through the shared structural validator — checking the partition, service, 12-digit account id, and a real-looking region code — and separately reports the instance id format warning if applicable, before revealing the copy action. A Load sample button fills in a realistic region, account, and modern-format instance id; Clear resets the form. Everything happens client-side — account ids and instance ids, both of which can be sensitive in some contexts, are never sent anywhere.