fix(compute): derive ARN partitions from the region

Merged
VI
19d ago
+1785-469

Summary

Part of the ARN partition campaign. Stacked on #2569 (includes its commits until it merges; review the fix(compute) commits).

Every ARN produced by the compute/API services now uses the region's partition (aws-cn, aws-us-gov, ISO), and every parser/dispatcher accepts any known partition. Each resource kind has one public ARN builder (function_arn, qualified_function_arn, layer_arn, state_machine_arn, execution_arn, ecs_arn, repository_arn, load_balancer_arn, target_group_arn, batch_arn, execute_api_arn, ...) for the CloudFormation provisioner to call in a later PR.

Crates: lambda, stepfunctions, ecs, ecr, batch, apigateway, apigatewayv2, appsync, elbv2, application-autoscaling, autoscaling, eks (+ a small fakecloud-core/fakecloud-sqs addition below).

Behavior changes in commercial regions (AWS-faithful):

  • Step Functions sqs:sendMessage resolves the target queue by account + name from its QueueUrl (new SqsDelivery::queue_arn_for_url) instead of rebuilding its ARN. Previously the ARN was rebuilt with a hardcoded us-east-1, so only us-east-1 queues worked. A missing queue now fails the task with SQS.QueueDoesNotExistException instead of silently dropping the message.
  • Step Functions ExecutionStarted history reports the state machine's real roleArn (captured at StartExecution) instead of a hardcoded placeholder role.

Other notes

  • ECS account settings are keyed by the principal with its partition normalized, so a setting written from one partition's region is read from another; keys persisted by older builds are normalized on load.
  • Cross-service dispatch (Step Functions task integrations, API Gateway v1/v2 integration URIs and AWS_PROXY SQS/SNS/Lambda/StepFunctions targets) accepts any partition.
  • Known limitation: state persisted by a cn/gov server before this change keeps arn:aws: rows.

No surface changes.

Test plan

  • China-region round-trip test per crate (create in cn-north-1, arn:aws-cn:, look up / tag / dispatch by it), cross-partition ECS account-settings test, snapshot key migration test, cross-region Step Functions SQS test, missing-queue failure test, role-at-start test. All fail on the pre-change code.
  • cargo test on the touched crates (1168 passed), cargo clippy --all-targets -D warnings, cargo fmt --check, scripts/publish-crates.sh --check.

Summary by cubic

Derives every ARN produced by the compute and API services from the region's partition (aws-cn, aws-us-gov, ISO) and makes ARN parsers and cross-service dispatch accept any partition, so resources created in China and GovCloud regions carry the correct partition. Each resource kind's ARN format now lives in one public builder for the CloudFormation provisioner to call later.

Behavior changes

  • Step Functions sqs:sendMessage resolves the target queue by account and name from its QueueUrl instead of rebuilding the ARN with a hardcoded us-east-1; a missing queue now fails the task with SQS.QueueDoesNotExistException instead of silently dropping the message.
  • ExecutionStarted history reports the state machine's real roleArn instead of a placeholder.
  • ECS per-principal account settings are keyed by normalized partition, and keys persisted by older builds are normalized on load.

State persisted by a cn/gov server before this change keeps arn:aws: rows. No surface changes.