fix(cloudformation): derive ARN partitions from the region and mint ARNs with the services' builders

Merged
VI
23d ago
+1560-704

Summary

Last PR of the ARN partition campaign (#2569, #2570, #2572, #2574, #2577, #2578, #2580, #2590). With every service now minting ARNs in the region's partition (aws-cn for cn-*, aws-us-gov for us-gov-*, ISO partitions), the CloudFormation provisioner now produces exactly the ARNs the service APIs produce, so stack-created and API-created resources agree (several services key state by ARN).

Partition-aware provisioner

  • Stack, stack-set (incl. legacy migration), change-set, type, hook, generated-template and scan ARNs use the stack/request region's partition. extras.rs ARNs that were pinned to us-east-1 now carry the request region (commercial-region change, AWS-faithful).
  • UpdateStackSet defaults the administration role in the stack set's own partition. SAM managed policies and integration URIs use ${AWS::Partition}.
  • Parsers (parse_log_group_name, Lambda function/alias/layer ARNs) accept any known partition.

Service builders instead of re-formatted ARNs
DynamoDB, RDS (DB instances, clusters, parameter/option groups, proxies), ElastiCache, EFS, Lambda (functions, versions, aliases, layers), Step Functions, ECS, ELBv2 (load balancers, target groups, trust stores, and listeners/rules derived from their parent ARN), Batch, Application Auto Scaling, Auto Scaling, EMR, SageMaker, ACM, ACM PCA, Cognito, Logs, CloudFront, Cloud Map, CodeBuild, CodeCommit, CodePipeline, CodeArtifact, CodeDeploy, Elastic Beanstalk, AppSync, WAFv2, Organizations, SNS, EventBridge, CloudWatch, SSM, Athena, and default KMS key ARNs via the KMS form.

Fidelity fixes in commercial regions (AWS-faithful)

  • Batch compute environments / job queues: ARNs no longer carry a -<uuid> suffix, so the Batch API finds stack-created ones by their ARN.
  • Organizations OUs/policies go through the service (create_ou/create_policy/attach_policy): duplicate names, unsupported/unknown types and malformed content fail with the API's errors; policy ARNs use the service's path segment; the resource-policy ARN matches DescribeResourcePolicy.
  • Regional WAFv2 ARNs use the regional/ segment; CLOUDFRONT scope uses the partition's global region (cn-northwest-1 in China).
  • Gateway load balancers get gwy/ ARNs.
  • Application Auto Scaling default roles are the documented service-linked role names (no doubled prefix, no invented _Default; EMR uses EMR_AutoScaling_DefaultRole).
  • Lambda layer version numbers are never reused after a delete, including when the last version is deleted (also in the Lambda API).

Known limitation: state persisted by a cn/gov server before the campaign keeps arn:aws: rows. No surface changes.

Test plan

  • China-region tests: stack/change-set/stack-set ARNs, provisioner ARNs across services, china_stack_arns_match_the_service_builders (SNS, EventBridge, CloudWatch, SSM, Athena, EFS/Timestream default keys), Organizations OU following the org's partition, WAF regional/CLOUDFRONT, ELBv2 listener derivation, Batch lookup by ARN, Organizations validation errors, layer version numbering, Application Auto Scaling default roles.
  • cargo test -p fakecloud-cloudformation (486), cargo check --workspace --all-targets, clippy -D warnings, cargo fmt --check, scripts/publish-crates.sh --check.

Summary by cubic

Finishes the ARN-partition campaign: the CloudFormation provisioner now derives partitions from the request region and mints resource ARNs using the owning services' builders, so stack-created and API-created resources carry identical ARNs.

Partition-aware provisioner

  • Stack, stack-set, change-set, type, hook, generated-template, and scan ARNs take the stack or request region's partition instead of arn:aws; extras pinned to us-east-1 now follow the request region (a commercial-region behavior change, AWS-faithful).
  • Organizations OUs and policies follow the organization's partition; SAM managed policies and integration URIs use ${AWS::Partition}.
  • Log-group and Lambda function/alias/layer ARN parsers accept any known partition.

Fidelity fixes in commercial regions

  • Batch compute environments and job queues drop the -<uuid> ARN suffix so the Batch API finds stack-created ones by ARN.
  • Organizations OUs and policies now go through the service's validation and fail with the API's error codes.
  • Regional WAFv2 ARNs use the regional/ segment and CLOUDFRONT uses the partition's global region.
  • Lambda layer version numbers are never reused after a delete, even when the last version is removed.
  • Application Auto Scaling defaults each namespace to its documented service-linked role instead of invented names.

Known limitation: state persisted by a cn/gov server before this campaign keeps arn:aws: rows; no surface changes.