AWS ARN (Amazon Resource Name) Regex for Python

What this pattern does

This page provides a comprehensive, battle-tested regular expression for matching aws arn (amazon resource name), ported and verified for Python. A rigorously tested regex reduces debugging time and protects your application from edge-case failures. The snippet below is ready to drop into your Python project — whether you're validating in a Django view, a FastAPI endpoint, or a standalone data processing script.

Python Implementation

# AWS ARN (Amazon Resource Name)
# ReDoS-safe | RegexVault — Dev & Systems > Environment

import re

aws_arn_amazon_resource_name_pattern = re.compile(r'^arn:(?:aws|aws-cn|aws-us-gov|aws-iso(?:-[a-z])?):([a-z0-9\-]+):([a-z0-9\-]*):([0-9]{12}|):([a-zA-Z0-9\-_/:.]+)$')

def validate_aws_arn_amazon_resource_name(value: str) -> bool:
    return bool(aws_arn_amazon_resource_name_pattern.fullmatch(value))

# Example
print(validate_aws_arn_amazon_resource_name("arn:aws:s3:::my-bucket"))  # True

Test Cases

When to use this pattern

This pattern is drawn from the Dev & Systems > Environment category and carries a ReDoS-safe certification. That matters for Python developers because particularly important in Python web servers where CPU-bound regex operations can stall concurrent request handling. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.

Common Pitfalls

Technical Notes

Groups: 1=service, 2=region (empty for IAM/S3), 3=account ID (empty for some services), 4=resource. S3 ARNs omit region and account. IAM ARNs include account but not region. Lambda ARNs include both.