From 44f1347c820a4b6f4725faa730304d0396368a1c Mon Sep 17 00:00:00 2001 From: Devendra Variya Date: Sun, 2 Aug 2026 20:50:26 +0530 Subject: [PATCH] Add ISO and eusc partitions to policy ARN suffix get_policy_arn_suffix only handled aws, aws-cn, and aws-us-gov, so ISO regions (us-iso, us-isob, eu-isoe, us-isof) and the eusc European Sovereign Cloud regions fell through to "aws". That produced invalid IAM policy ARNs (arn:aws:... instead of arn:aws-iso:...) in emr create-default-roles, dlm create-default-role, and emr-containers update-role-trust-policy. Add the missing partitions, matching botocore's region-to-partition data, with us-isob/us-isof checked before the general us-iso prefix. Unknown regions still fall back to "aws". --- .changes/next-release/bugfix-emr-20663.json | 5 +++++ awscli/customizations/utils.py | 12 ++++++++++++ tests/unit/customizations/test_utils.py | 15 +++++++++++++++ 3 files changed, 32 insertions(+) create mode 100644 .changes/next-release/bugfix-emr-20663.json diff --git a/.changes/next-release/bugfix-emr-20663.json b/.changes/next-release/bugfix-emr-20663.json new file mode 100644 index 000000000000..010dd74fb6e8 --- /dev/null +++ b/.changes/next-release/bugfix-emr-20663.json @@ -0,0 +1,5 @@ +{ + "type": "bugfix", + "category": "emr", + "description": "Fixed the ARN partition suffix returned by ``get_policy_arn_suffix`` for AWS ISO (``aws-iso``, ``aws-iso-b``, ``aws-iso-e``, ``aws-iso-f``) and European Sovereign Cloud (``aws-eusc``) regions, so ``emr create-default-roles``, ``dlm create-default-role`` and ``emr-containers update-role-trust-policy`` build valid IAM policy ARNs in those partitions instead of defaulting to ``aws``." +} diff --git a/awscli/customizations/utils.py b/awscli/customizations/utils.py index c5055418c4c3..4f81b3c9bfef 100644 --- a/awscli/customizations/utils.py +++ b/awscli/customizations/utils.py @@ -226,5 +226,17 @@ def get_policy_arn_suffix(region): return "aws-cn" elif region_string.startswith("us-gov"): return "aws-us-gov" + # The isob/isof prefixes must be checked before the more general "us-iso" + # prefix, since "us-isob-east-1" also starts with "us-iso". + elif region_string.startswith("us-isob"): + return "aws-iso-b" + elif region_string.startswith("us-isof"): + return "aws-iso-f" + elif region_string.startswith("us-iso"): + return "aws-iso" + elif region_string.startswith("eu-isoe"): + return "aws-iso-e" + elif region_string.startswith("eusc-"): + return "aws-eusc" else: return "aws" diff --git a/tests/unit/customizations/test_utils.py b/tests/unit/customizations/test_utils.py index 8b003361e090..7d7513e9c3a6 100644 --- a/tests/unit/customizations/test_utils.py +++ b/tests/unit/customizations/test_utils.py @@ -267,3 +267,18 @@ def test_get_policy_arn_suffix(self): self.assertEqual("aws", utils.get_policy_arn_suffix("us-east-1")) self.assertEqual("aws", utils.get_policy_arn_suffix("sa-east-1")) self.assertEqual("aws", utils.get_policy_arn_suffix("ap-south-1")) + self.assertEqual( + "aws-iso", utils.get_policy_arn_suffix("us-iso-east-1") + ) + self.assertEqual( + "aws-iso-b", utils.get_policy_arn_suffix("us-isob-east-1") + ) + self.assertEqual( + "aws-iso-e", utils.get_policy_arn_suffix("eu-isoe-west-1") + ) + self.assertEqual( + "aws-iso-f", utils.get_policy_arn_suffix("us-isof-south-1") + ) + self.assertEqual( + "aws-eusc", utils.get_policy_arn_suffix("eusc-de-east-1") + )