Add ISO and eusc partitions to policy ARN suffix - #10526
Open
fixedbydev wants to merge 1 commit into
Open
Conversation
get_policy_arn_suffix only handled aws, aws-cn, and aws-us-gov, so ISO regions (us-iso, us-isob, eu-isoe, us-isof) and the eusc European Sovereign Cloud regions fell through to "aws". That produced invalid IAM policy ARNs (arn:aws:... instead of arn:aws-iso:...) in emr create-default-roles, dlm create-default-role, and emr-containers update-role-trust-policy. Add the missing partitions, matching botocore's region-to-partition data, with us-isob/us-isof checked before the general us-iso prefix. Unknown regions still fall back to "aws".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
get_policy_arn_suffixonly handled the aws, aws-cn, and aws-us-gov partitions. In an ISO region likeus-iso-east-1, or the newereuscEuropean Sovereign Cloud regions, it fell through to"aws", so the IAM policy ARNs built byemr create-default-roles,dlm create-default-role, andemr-containers update-role-trust-policycame out with the wrong partition (arn:aws:...instead ofarn:aws-iso:...), which is invalid in those partitions.This adds the missing partitions, matching botocore's own region-to-partition data (verified against
botocore.session.Session().get_partition_for_region):us-isoaws-isous-isobaws-iso-beu-isoeaws-iso-eus-isofaws-iso-feusc-aws-euscThe
us-isobandus-isofchecks are ordered before the more generalus-isocheck, sinceus-isob-east-1also starts withus-iso. Unknown regions still fall back to"aws"as before, so the change is additive.I kept the existing hardcoded-prefix shape and signature rather than delegating to botocore's resolver, since that would need a session/config passed in and would raise on brand-new regions instead of the current safe
"aws"fallback. Happy to switch to the resolver approach instead if you'd prefer.Added test coverage for each new partition in
TestGetPolicyARNSuffix.Generated by AI tools, and reviewed by fixedbydev.