S3 URI / URL / ARN Converter

Convert any S3 reference into all equivalent forms. Paste an s3:// URI, a virtual-hosted HTTPS URL (bucket.s3.region.amazonaws.com/key), a path-style URL (s3.region.amazonaws.com/bucket/key), or an S3 ARN — the tool auto-detects the format, extracts bucket, key, and region, then outputs all four representations with individual copy buttons.

How to use the S3 URI / URL / ARN Converter

Paste any S3 reference into the input field and click Convert (or just type — it updates live). Accepted input formats:

  • S3 URI: s3://bucket-name/path/to/key
  • Virtual-hosted URL: https://bucket-name.s3.us-east-1.amazonaws.com/path/to/key
  • Path-style URL: https://s3.us-east-1.amazonaws.com/bucket-name/path/to/key (also accepts the legacy https://s3.amazonaws.com/bucket/key)
  • ARN: arn:aws:s3:::bucket-name/path/to/key or just arn:aws:s3:::bucket-name

If the input URL contains a region (e.g. s3.us-east-1.amazonaws.com), it is extracted automatically. Otherwise, use the Region field to specify one — this affects the virtual-hosted and path-style URL outputs. If no region is provided, the virtual-hosted URL uses us-east-1 as a default placeholder.

The output panel shows the detected bucket name, key (object path), region, and all four equivalent forms. Each form has its own Copy button.

S3 URL Formats Explained

Amazon S3 objects can be addressed in four distinct syntactic forms, each used in different contexts. The S3 URI (s3://bucket/key) is the canonical form used in the AWS CLI, boto3, Spark, and most big-data tools. It is not a real HTTP URL — no browser can fetch it directly — but it is the most compact and unambiguous reference to an S3 object.

The virtual-hosted style URL (https://bucket.s3.region.amazonaws.com/key) is the current AWS-recommended HTTPS form. The bucket name is part of the hostname, which means it must be DNS-compliant (lowercase, no underscores). AWS has been deprecating the older path-style URL (https://s3.region.amazonaws.com/bucket/key) since 2020, but it is still widely seen in legacy code, some SDKs, and documentation. Both forms return the object over HTTPS when the bucket policy permits public or authenticated access.

The S3 ARN (arn:aws:s3:::bucket-name for the bucket, arn:aws:s3:::bucket-name/key for an object) is used exclusively in IAM policy Resource fields and a few AWS service configurations. Note that S3 ARNs do not include a region or account-id — S3 bucket names are globally unique, so the ARN does not need to scope them further. This converter handles the common formats and notes where region information is unavailable in ARN inputs.

Common use cases

  • IAM policy writing — convert an S3 URI from your config file into the ARN format required in a policy Resource field.
  • SDK migration — translate a legacy path-style URL in old code into the current virtual-hosted format for AWS SDK v3 compatibility.
  • Presigned URL debugging — extract the bucket and key from a long presigned URL to identify the exact object being accessed.
  • CloudFormation / Terraform — get the S3 URI from a console URL to use as a value in infrastructure-as-code resource references.
  • Data pipeline configuration — convert between the URI format (used in Spark/EMR) and HTTPS form (used in direct API calls) without manual string manipulation.

Frequently asked questions

Why don't S3 ARNs include a region or account ID?

S3 bucket names are globally unique across all AWS accounts and regions, so the ARN format for S3 does not need to scope resources by region or account. The ARN format is arn:aws:s3:::bucket-name, with the region and account fields left empty.

What is the difference between virtual-hosted and path-style URLs?

In virtual-hosted URLs the bucket is part of the subdomain (bucket.s3.region.amazonaws.com); in path-style URLs it is the first path segment (s3.region.amazonaws.com/bucket). Path-style is being deprecated and requires the bucket name to not conflict with existing S3 hostnames.

Can I use a bucket name with dots in virtual-hosted URLs?

Bucket names with dots (e.g. my.bucket.name) cause SSL certificate validation issues with virtual-hosted URLs because the wildcard certificate *.s3.amazonaws.com does not match multiple subdomain levels. AWS recommends avoiding dots in new bucket names.

Does converting the URL format change access permissions?

No — the different URL formats all reach the same S3 object via the same API. Permissions are governed by bucket policies and IAM, not by the URL format used to access the object.

What is the key in an S3 URL?

The key is the full path to the object within the bucket, analogous to a file path. It can contain / characters (which S3 treats as part of the key, not actual directories) and is everything after the bucket name in the URI.