fix(f2): derive ARN partitions from the region

Merged
VI
19d ago
+1299-262

Summary

Part of the ARN partition campaign. Stacked on #2569 (includes its commits until it merges; review the three fix(f2) commits).

Every ARN produced by these services uses the region's partition (aws-cn, aws-us-gov, ISO), and parsers accept any known partition. Public ARN builders for the CloudFormation provisioner: codedeploy, elasticbeanstalk, cloudfront (cloudfront_arn, distribution_arn), servicediscovery, codebuild project_arn, codecommit repo_arn, codepipeline pipeline_arn/webhook_arn, codeartifact domain/repo/package-group.

Crates: s3 (ARN producers/parsers only), s3tables, cloudfront, route53, route53resolver, servicediscovery, amplify, codebuild, codecommit, codedeploy, codepipeline, codeconnections, codeartifact, appconfig, elasticbeanstalk, serverlessrepo, ce.

Behavior changes in commercial regions (AWS-faithful):

  • S3 access-point IAM resource is the regional access-point ARN (arn:aws:s3:<region>:<account>:accesspoint/<name>) instead of arn:aws:s3:::accesspoint/<name>, so policies written against real access-point ARNs match.
  • S3 IAM bucket/object resources use the bucket's own region partition, matching ListBuckets/x-amz-bucket-arn.
  • Serverless Application Repository change-set ID is a well-formed arn:<p>:cloudformation:<region>:<account>:changeSet/<name>/<uuid> honoring changeSetName (was arn:aws:cloudformation:changeSet/<uuid>).
  • CodeBuild Secrets Manager references resolve only by exact ARN or a true partial ARN (- + 6 chars), fixing a partial ARN matching a longer secret name.
  • CloudFront realtime log configs are found by name regardless of the region that created them.

Deliberately unchanged: the S3 SSE-KMS encryption-context bucket ARN stays aws so encrypt and decrypt keep agreeing for stored objects. Amplify's tag ARN check accepts any known partition (the Smithy pattern is literal aws), otherwise China apps can't be tagged by their own ARN.

Known limitation: state persisted by a cn/gov server before this change keeps arn:aws: rows. No surface changes.

Test plan

  • China-region test per crate, parser tests (route53, codebuild, s3), access-point/bucket-region IAM resource tests, change-set name tests, strict secret-ARN tests, cross-partition realtime-log-config test. All fail on the pre-change code.
  • cargo test on the 17 crates, cargo clippy --all-targets -D warnings, cargo fmt --check.

Summary by cubic

ARNs produced by 17 services now derive their partition from the region (aws-cn, aws-us-gov, ISO) instead of hardcoding aws, and parsers accept any known partition. Adds Arn::regional, Arn::global_in, Arn::s3_in, arn_resource, and partition_of helpers in fakecloud-aws; IAM seeds each account's service-linked roles in the server's configured region's partition.

Behavior changes in commercial regions (AWS-faithful)

  • S3 access-point IAM resources became the regional access-point ARN; bucket and object IAM resources now take the bucket's own region partition.
  • Serverless Application Repository change-set IDs are now well-formed arn:<p>:cloudformation:<region>:<account>:changeSet/<name>/<uuid> and honor changeSetName.
  • CodeBuild Secrets Manager references resolve only by exact ARN or true partial ARN (- plus 6 random chars).
  • CloudFront realtime log configs are found by name regardless of the region that created them.

Deliberately unchanged

  • S3 SSE-KMS encryption-context bucket ARNs stay aws so encrypt and decrypt keep agreeing; Amplify tag ARN checks accept any known partition.
  • Known limitation: cn/gov state persisted before this change keeps arn:aws: rows.