arn

func Build ¶

func Build(service, region, accountID, resource string) string

Build constructs an AWS ARN from the given components. For IAM (service == "iam"), the region is omitted as IAM is a global service. The partition is derived from the region so GovCloud, China, and ISO regions produce wire-correct ARNs. Format: arn:{partition}:{service}:{region}:{accountID}:{resource}.

func BuildGlobal ¶ added in v1.2.0

func BuildGlobal(service, region, accountID, resource string) string

BuildGlobal constructs an AWS ARN for a resource kind that is global (no region segment) even though the owning service is otherwise regional -- e.g. Direct Connect's DirectConnectGateway (confirmed via the real Terraform AWS provider source: `c.GlobalARN(ctx, "directconnect", "dx-gateway/"+id)`, gateway.go's gatewayARN). This differs from Build's existing service==\"iam\" special case, which is a whole-service exception: BuildGlobal is for services that are region-scoped for every OTHER resource kind but have one specific global resource kind, so the caller opts in per call site rather than the region omission being baked into the service name. The partition is still derived from region (regional resources of the same service may need it for GovCloud/China/ISO callers), even though region itself is omitted from the resulting ARN. Format: arn:{partition}:{service}::{accountID}:{resource}.

func BuildS3 ¶

func BuildS3(resource string) string

BuildS3 constructs an ARN for an S3 resource. S3 ARNs have no region or account ID component. Format: arn:aws:s3:::{resource}.

func Canonical ¶

func Canonical(text string) string

Canonical rewrites every non-commercial ARN partition in text to "aws" (plain and URL-encoded), the form global-service backends store and evaluate policies in.

func FindMismatch ¶

func FindMismatch(text, partition string, tolerateCommercial bool) (string, bool)

FindMismatch scans text for embedded ARNs and returns the first whose partition differs from partition. With tolerateCommercial, "aws" ARNs never count as mismatches: global services (IAM, S3, ...) still emit them regardless of the request region.

func HasService ¶

func HasService(arnStr, svc string) bool

HasService reports whether arnStr is an ARN of the given service in any known partition.

func Localize ¶

func Localize(text, partition string) string

Localize rewrites every "aws" partition ARN in text to partition (plain and URL-encoded).

func Partition ¶

func Partition(arnStr string) string

Partition returns the partition segment of arnStr, or "" when arnStr is not a well-formed ARN of a known partition.

func PartitionForRegion ¶

func PartitionForRegion(region string) string

PartitionForRegion returns the AWS partition (e.g. "aws", "aws-us-gov", "aws-cn", "aws-iso", "aws-iso-b") for the given region. Empty or unknown regions resolve to the standard "aws" partition.

Real AWS resources living in GovCloud or China use distinct ARN partitions and clients reject cross-partition ARNs. Use this helper when constructing ARNs from a region whose partition is not known a priori.

func PartitionStrict ¶

func PartitionStrict() bool

PartitionStrict reports whether cross-partition ARNs are rejected (the default).

func S3 ¶

func S3(region, resource string) string

S3 builds an S3 resource ARN in the partition of region.

func ValidateForRegion ¶

func ValidateForRegion(region, arnStr string) error

ValidateForRegion returns an ErrPartitionMismatch-wrapping error when arnStr names a known partition other than the one region belongs to. Non-ARN input and empty regions pass.

func WithPartition ¶

func WithPartition(region, arnStr string) string

WithPartition rewrites the partition of arnStr to match region. Non-ARNs are returned unchanged.