fix(data): derive ARN partitions from the region

Merged
VI
19d ago
+1274-529

Summary

Part of the ARN partition campaign. Stacked on #2569 (includes its commits until it merges; review the two fix(data)/follow-up commits).

Every ARN produced by EC2 and the database/storage services now uses the region's partition (aws-cn, aws-us-gov, ISO), and every parser accepts any known partition. Each resource kind has one public ARN builder taking the region (rds_arn, elasticache_arn, table_arn, ec2_arn, redshift_arn, backup/efs/kafka/mq/opensearch/timestream/dsql/glacier builders) so the CloudFormation provisioner can call it in a later PR.

Crates: ec2, rds, elasticache, memorydb, docdb, neptune, redshift, dsql, efs, opensearch, mq, kafka, dms, dynamodb, backup, glacier, timestream.

Commercial-region output changes (intentional, AWS-faithful):

  • DocDB DescribeCertificates CertificateArn now names the queried region (was hardcoded us-east-1), e.g. arn:aws:rds:us-west-2::cert:rds-ca-rsa2048-g1.

Otherwise commercial output is byte-identical.

Deliberately unchanged here: KMS key ARNs (RDS format_kms_arn, EFS/Kafka/Timestream default keys) stay aws until the KMS batch converts KMS itself, so they keep matching what KMS reports.

Known limitation: state persisted by a cn/gov server before this change keeps arn:aws: rows.

No surface changes.

Test plan

  • China-region test per crate (create in cn-north-1, assert arn:aws-cn:, look up/tag by that ARN; builder-level for glacier/opensearch/backup/dsql/timestream), DynamoDB parser test, DocDB certificate region test. All fail with partition derivation disabled.
  • cargo test on all 17 crates (1,912 tests), cargo clippy --all-targets -D warnings, cargo fmt.

Summary by cubic

Derives ARN partitions from each request's region across 17 service crates, so resources created in China, GovCloud, and ISO regions now produce aws-cn, aws-us-gov, and isolated partitions instead of aws. Every ARN parser accepts any known partition.

  • Adds shared builders (Arn::regional, Arn::global_in, Arn::s3_in) and reuses arn_resource for partition-agnostic parsing.
  • IAM seeds new accounts' service-linked roles in the server region's partition; STS and GetUser default principals use the request's partition.
  • Adds China-region tests per service covering create, ARN lookup, and tagging.

Migration

  • DocDB DescribeCertificates CertificateArn now names the queried region; commercial-region output is otherwise byte-identical.
  • KMS key ARNs stay in aws until the KMS batch lands, to keep matching what KMS reports.
  • State persisted before this change in cn/gov servers keeps arn:aws: rows.