Split and validate any Amazon Resource Name, build ARNs for 30+ resource types including Amazon Connect, and pull every ARN out of a policy or template.
Last updated
Parse and validate an ARN
Examples:
Build an ARN
Find every ARN in text
Paste an IAM policy, CloudFormation output, a contact flow export or a log. Every ARN is listed with its account and region — handy for spotting hard-coded accounts before moving between environments.
An Amazon Resource Name has the form arn:partition:service:region:account-id:resource. The partition is usually aws, the region and 12-digit account ID identify where the resource lives, and the resource part is service-specific, such as role/MyRole, function:my-function or instance/ID/queue/ID.
Why do S3 and IAM ARNs have empty parts?
S3 bucket names are global, so bucket and object ARNs leave region and account empty: arn:aws:s3:::my-bucket/key. IAM is a global service, so IAM ARNs leave the region empty but include the account: arn:aws:iam::123456789012:role/MyRole.
What does an Amazon Connect ARN look like?
Connect resources sit under their instance: arn:aws:connect:REGION:ACCOUNT:instance/INSTANCE_ID/queue/QUEUE_ID. Flows use contact-flow, users use agent, quick connects use transfer-destination, and claimed phone numbers use phone-number/ID directly under the account.
Can I use wildcards in an ARN?
Wildcards (* and ?) are allowed in the Resource element of IAM policies, for example arn:aws:s3:::my-bucket/* for every object. They are not valid where an API expects one real resource ARN.
How do I find the ARN of a resource?
Most consoles show the ARN on the resource page, and CLI describe or get commands return it, for example aws lambda get-function or aws connect describe-instance. You can also build it here from the account, region and resource ID.
Practical guide
ARN format, part by part
arn:partition:service:region:account-id:resource
partition — aws for most Regions, aws-cn for China, aws-us-gov for GovCloud.
service — the service namespace, such as lambda, connect or s3.
region — for example us-east-1; empty for global services such as IAM and for S3 buckets.
account-id — 12 digits; empty for S3 buckets and AWS-owned resources such as Bedrock foundation models.
resource — service-specific, often type/id or type:name, and can include paths (role/service/MyRole) or qualifiers (function:my-fn:prod).
Amazon Connect ARNs
Most Connect resources live under their instance: arn:aws:connect:REGION:ACCOUNT:instance/INSTANCE_ID/queue/QUEUE_ID. Flows are contact-flow, users are agent, quick connects are transfer-destination and hours are operating-hours. When you copy flows between environments, these IDs change — use the extractor here to list them, and the ARN Parameterizer to replace them.