fix(f1): derive ARN partitions from the region

Merged
VI
19d ago
+1824-397

Summary

Part of the ARN partition campaign. Stacked on #2569 (includes its commits until it merges; review the fix(f1) commits).

Every ARN produced by these services uses the region's partition (aws-cn, aws-us-gov, ISO), with one public builder per resource kind (bedrock/bedrock-agent/bedrock-agent-runtime arns.rs, sagemaker, textract, glue, mwaa, emr, fis, iot, iotwireless, managedblockchain, mediaconvert, swf, transfer, comprehend, translate, transcribe).

Behavior changes (AWS-faithful):

  • Bedrock system (us.*) inference profiles are listed only when the caller's region is in the commercial partition; their model ARNs use each model region's own partition. us-east-1 output unchanged.
  • Bedrock Agent Runtime: a full flow ARN passed as flowIdentifier is reduced to the bare flow id, so execution ARNs no longer nest an ARN inside an ARN.
  • Glue CreateSchema: schema ARNs follow the registry's stored region; a named registry that doesn't exist returns EntityNotFoundException (was: invented a RegistryArn); no RegistryId uses default-registry, created on first use.
  • Reads return each resource's stored ARN rather than recomputing it from the caller's region (managedblockchain, emr, mwaa, glue, bedrock-agent flows/prompts, iot).

Bedrock-agent flow/prompt ARNs missing from older snapshots are backfilled once at load. Known limitation: state persisted by a cn/gov server before this change keeps arn:aws: rows. No surface changes.

Test plan

  • China-region test per crate (create in cn-north-1, arn:aws-cn:, describe/tag by that ARN), inference-profile partition tests, bare-flow-id tests, Glue registry tests, bedrock-agent ARN backfill test. All fail on the pre-change code.
  • cargo test on the 18 crates, cargo clippy --all-targets -D warnings, cargo fmt --check.

Summary by cubic

Derives ARN partitions from the region across 18 services so resources created in cn-*, us-gov-*, and ISO regions carry arn:aws-cn, arn:aws-us-gov, or the ISO partition instead of arn:aws. Also corrects several ARN behaviors to match AWS.

Behavior changes

  • Bedrock system inference profiles are listed only when the caller's region is in the commercial partition; their model ARNs use each model region's own partition.
  • Bedrock Agent Runtime reduces a full flow ARN passed as flowIdentifier to the bare flow id, so execution ARNs no longer nest an ARN inside an ARN. Other flow, alias, and session identifier behavior stays as before.
  • Glue CreateSchema builds the schema ARN from its registry's stored region; a named registry that doesn't exist returns EntityNotFoundException, and omitting RegistryId creates default-registry on first use.
  • Reads return each resource's stored ARN instead of recomputing it from the caller's region (managedblockchain, emr, mwaa, glue, bedrock-agent flows/prompts, iot).
  • Bedrock-agent flow and prompt ARNs missing from older snapshots are backfilled once at load; state persisted by a cn/gov server before this change keeps its arn:aws: rows.