fix: mint default KMS key ARNs in the region's partition and convert the remaining hardcoded partitions

Merged
VI
19d ago
+264-64

Summary

Final service-side pass of the ARN partition campaign (after #2569, #2570, #2572, #2574, #2577, #2578, #2580). The CloudFormation provisioner follows in a separate PR that calls the builders exported here.

KMS consumers

  • RDS format_kms_arn (key ids and alias/...), the EFS default KmsKeyId, Kafka's default data-volume key and Timestream's default database key are built as Arn::regional("kms", region, account, "key/<id>"), the same form KMS itself mints, so they're in the region's partition. fakecloud-kms is only a dev-dependency (tests assert equality with kms_key_arn).

Remaining hardcoded partitions

  • Athena workgroup, data catalog and capacity reservation ARNs use the region's partition through one exported athena_arn.
  • Bedrock prompt routers with no models report their default/fallback model ARN in the router's own region and partition (read from the router ARN, falling back to the request region) instead of a hardcoded arn:aws:bedrock:us-east-1:.... Behavior change in commercial regions: a router outside us-east-1 now reports its own region in that ARN.

Builders exported for the CloudFormation provisioner (output unchanged): SNS topic_arn, EventBridge bus_arn/rule_arn, CloudWatch alarm_arn, SSM param_arn, Athena athena_arn.

Deliberately left aws (sweep of every runtime arn:aws: outside CloudFormation): the S3 SSE-KMS and SES-inbound encryption-context bucket ARN (encrypt and decrypt must agree for stored objects), the anonymous S3 probe in core dispatch, a discarded AWS-managed-policy fallback in STS, and Step Functions' internal s3:getObject/putObject defaults (only substring-matched). fakecloud-identitystore builds and reads no ARNs.

No surface changes.

Test plan

  • New cn-north-1 tests: RDS (key + alias), EFS, Kafka, Timestream (each equal to kms_key_arn, us-east-1 unchanged), Athena (builders + tag round-trip on the aws-cn ARN), Bedrock router default model (get/list, region fallback). All fail without the change.
  • cargo test on the touched crates, cargo clippy --all-targets -D warnings, cargo fmt --check, scripts/publish-crates.sh --check, cargo check --workspace --all-targets.

Summary by cubic

Fixes synthesized ARNs to use the region's partition, so resources in China and GovCloud get ARNs that match what the services themselves mint. Exports partition-aware ARN builders for the CloudFormation provisioner.

Bug Fixes

  • RDS, EFS, Kafka, and Timestream default KMS key ARNs are now built in the region's partition.
  • Athena workgroup, data catalog, and capacity reservation ARNs now use the region's partition.
  • Bedrock prompt routers without models now report their default model ARN in the router's own region and partition instead of a fixed us-east-1 (behavior change for commercial routers outside us-east-1).