fix(messaging): derive ARN partitions from the region

Merged
VI
20d ago
+1454-373

Summary

Part of the ARN partition campaign. Stacked on #2569 (includes its commits until it merges; review only the last commit, fix(messaging): ...).

Every ARN the messaging/logging services produce now uses the region's partition (aws-cn for cn-*, aws-us-gov for us-gov-*, ISO partitions), and every parser accepts any known partition. Commercial-region output is byte-identical.

Crates: sqs, sns, eventbridge, scheduler, pipes, kinesis, firehose, kinesisanalyticsv2, logs, cloudwatch, xray, cloudtrail, ses, pinpoint.

  • One ARN builder per resource kind where a format was repeated (SES: 7 helpers replacing 18 hand-rolled formats; topic_arn, bus_arn, rule_arn, alarm_arn, public fakecloud_logs::log_group_arn).
  • AddPermission/PutPermission/PutEvents root principals take their partition from the resource's own ARN, so principal and resource always agree.
  • Validation (is_sqs_queue_arn, is_sns_topic_arn, is_event_bus_arn, SNS sqs endpoint, Logs PutDeliverySource) goes through arn_resource, which rejects malformed/unknown partitions as before.
  • EventBridge default bus: a client in another region/partition than the server can tag, list tags and set permissions with the ARN it was handed (EventBus::answers_to).

CloudFormation's provisioners for these services are converted in a later PR that merges after all service batches, so API- and stack-created resources agree.

No surface changes (no new API/flag/SDK field).

Test plan

  • 14 new china_region_* round-trip unit tests (one per crate) + default_bus_arn_handed_to_a_china_region_caller_resolves; all fail on the pre-change code.
  • cargo test on all 14 crates (28 suites ok), cargo clippy --all-targets -D warnings, cargo fmt --check, scripts/publish-crates.sh --check.

Summary by cubic

The messaging and logging services now generate every ARN in the partition of its region (aws-cn for cn-*, aws-us-gov for us-gov-*, aws otherwise) and accept any known partition when parsing. Commercial-region output is byte-identical, no API or SDK surface changes, and 15 new China-region round-trip tests cover the change.

  • Consolidated repeated hand-rolled ARN formats into per-resource builders (SES now uses 7 helpers instead of 18 formats; topic_arn, bus_arn, rule_arn, alarm_arn, and fakecloud_logs::log_group_arn are public).
  • Root principals in AddPermission/PutPermission/PutEvents take their partition from the resource's own ARN so principal and resource always agree.
  • ARN validation (is_sqs_queue_arn, is_sns_topic_arn, is_event_bus_arn, SNS SQS endpoint, Logs PutDeliverySource) goes through arn_resource, which rejects malformed or unknown partitions as before.
  • EventBridge's bootstrap default bus now resolves against the ARN a cross-region or cross-partition caller was handed.