A fixed six-field format covering every AWS service

Every ARN follows the same six-colon-delimited structure — partition, service, region, account ID, and resource — regardless of which of the hundreds of AWS services it identifies, which is exactly what lets a single generic parser handle an IAM role ARN, an S3 bucket ARN, and a Lambda function ARN identically. What varies between services is which fields are populated: IAM is a global (not regional) service, so its ARNs leave the region field blank; S3 bucket ARNs leave both region and account ID blank, since bucket names are globally unique across all of AWS. A blank field in an ARN is normal and service-specific, not a sign anything is wrong with the ARN.

Why the resource part needs its own parsing step

Unlike the first five fields, which are always separated by colons, the resource portion of an ARN is where individual services get to define their own internal structure — some use a `/` to separate a resource type from its ID (`role/MyRole`), some use a `:` for the same purpose (`db:mydatabase`), and some just use a bare ID with no type prefix at all. That inconsistency exists because the resource portion is effectively AWS delegating format ownership to whichever service the ARN belongs to, which is why this tool has to detect the separator style within the resource field itself rather than applying one fixed rule the way it can for the first five colon-delimited fields.