AWS ARN (Amazon Resource Name)
Match AWS ARNs (Amazon Resource Names) across commercial, China, and GovCloud partitions.
Try it in RegexPro →Available in
JavaScript / ECMAScript code
const re = new RegExp("arn:(?:aws|aws-cn|aws-us-gov):[a-z0-9\\-]+:[a-z0-9\\-]*:\\d{12}?:[\\w\\-\\/.*:]+", "g");
const input = "Bucket arn:aws:s3:::my-app-bucket/path";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).
Python (re) code
import re
pattern = re.compile(r"arn:(?:aws|aws-cn|aws-us-gov):[a-z0-9\-]+:[a-z0-9\-]*:\d{12}?:[\w\-\/.*:]+")
input_text = "Bucket arn:aws:s3:::my-app-bucket/path"
for m in pattern.finditer(input_text):
print(m.group(0))Stdlib `re` module — no third-party dependency. Works on Python 3.6+.
Go (RE2) code
package main
import (
"fmt"
"regexp"
)
func main() {
re := regexp.MustCompile(`arn:(?:aws|aws-cn|aws-us-gov):[a-z0-9\-]+:[a-z0-9\-]*:\d{12}?:[\w\-\/.*:]+`)
input := `Bucket arn:aws:s3:::my-app-bucket/path`
for _, match := range re.FindAllString(input, -1) {
fmt.Println(match)
}
}Uses `regexp.MustCompile` (panics on bad patterns at startup) and `FindAllString` for all matches.
Pattern
arn:(?:aws|aws-cn|aws-us-gov):[a-z0-9\-]+:[a-z0-9\-]*:\d{12}?:[\w\-\/.*:]+ (flags: g)Raw source: arn:(?:aws|aws-cn|aws-us-gov):[a-z0-9\-]+:[a-z0-9\-]*:\d{12}?:[\w\-\/.*:]+
How it works
Examples
Input
Bucket arn:aws:s3:::my-app-bucket/pathMatches
arn:aws:s3:::my-app-bucket/path
Input
Lambda arn:aws:lambda:us-east-1:123456789012:function:helloMatches
arn:aws:lambda:us-east-1:123456789012:function:hello
Input
no arns hereNo match
—Common use cases
- •IAM policy linting and parsing
- •CloudFormation / Terraform validation
- •Secret scanning for accidentally hardcoded ARNs
- •Cost allocation tooling that joins ARNs to billing data
Related patterns
AWS S3 Bucket Name
IdentifiersValidate AWS S3 bucket names per the standard naming rules: 3–63 chars, lowercase, alphanumeric + dots + hyphens.
Kubernetes Pod Name (RFC 1123)
IdentifiersValidate Kubernetes pod names per the RFC 1123 DNS label rules — lowercase, ≤63 chars, no leading/trailing hyphen.
npm Package Name
IdentifiersValidate npm package names including scoped packages (@org/package), per the npm naming spec.
Python Package Name (PEP 508)
IdentifiersValidate Python distribution package names per PEP 508: letters, digits, dots, underscores, hyphens.