add_cloudwatch_action <ec2 autorecover actions>: works only in aws partition

[GregChapmanAtRack]

Describe the bug

When deploying EC2 instances in any partition other than commercial, stack rolls back when EC2 recover and reboot actions are added to an alarm.

Expected Behavior

Alarm to be created with specified action, for example:

cw_alarm4.add_alarm_action(cloudwatch_actions.Ec2Action(cloudwatch_actions.Ec2InstanceAction.REBOOT))

Current Behavior

"<timestamp>| CREATE_FAILED        | AWS::CloudWatch::Alarm    | CloudwatchAlarm287DB52F9
Invalid partition aws specified. Only aws-us-gov is supported. (Service: AmazonCloudWatch; Status Code: 400; Error Code: ValidationError; Request ID: f61066f0-d59c-42f0-bf39-99ea1c0d3cc2;
Proxy: null)"

Reproduction Steps

    cw_alarm4 = cloudwatch.Alarm(
        scope=self,
        id="Cloudwatch Alarm 4",
        comparison_operator=cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
        evaluation_periods=1,
        actions_enabled=True,
        alarm_description="Status checks have failed, REBOOTING/RECOVERING system - " +
        instance1,
        alarm_name="Instance Status Check Failed - "+instance1+" recovery",
        datapoints_to_alarm=None,
        metric=instance1_metric2,
        threshold=0,
        treat_missing_data=None
    )
    cw_alarm4.add_alarm_action(cloudwatch_actions.Ec2Action(
        cloudwatch_actions.Ec2InstanceAction.REBOOT))

Works in AWS partition. Does not work in aws-us-gov

Possible Solution

I believe the error resides in https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-cloudwatch-actions/lib/ec2.ts#L40-L46

Suggest distilling partition from env variable AWS_DEFAULT_REGION, .aws/config values, etc.

Additional Information/Context

No response

CDK CLI Version

2.19.0 (build e0d3e62)

Framework Version

No response

Node.js Version

v16.11.1

OS

NAME="Ubuntu" VERSION="20.04.4 LTS (Focal Fossa)"

Language

Python

Language Version

Python 3.10.0

Other information

No response

[GregChapmanAtRack]

I have confirmed in the json output that this function is returning the offending arn:

    "CloudwatchAlarm287DB52F9": {
      "Type": "AWS::CloudWatch::Alarm",
      "Properties": {
        "ComparisonOperator": "GreaterThanThreshold",
        "EvaluationPeriods": 1,
        "ActionsEnabled": true,
        "AlarmActions": [
          "arn:aws:automate:us-gov-west-1:ec2:reboot",
          "arn:aws:automate:us-gov-west-1:ec2:recover"
        ],
        "AlarmDescription": {
          "Fn::Join": [
            "",
            [
              "Status checks have failed, REBOOTING/RECOVERING system - ",
              {
                "Ref": "AlarmTestlinuxB31B50A2"
              }
            ]
          ]
        },
        "AlarmName": {
          "Fn::Join": [
            "",
            [
              "System Status Check Failed - ",
              {
                "Ref": "AlarmTestlinuxB31B50A2"
              },
              " recovery"
            ]
          ]
        },
        "Dimensions": [
          {
            "Name": "InstanceId",
            "Value": {
              "Ref": "AlarmTestlinuxB31B50A2"
            }
          }
        ],
        "MetricName": "StatusCheckFailed_System",
        "Namespace": "AWS/EC2",
        "Period": 60,
        "Statistic": "Minimum",
        "Threshold": 0
      },
      "Metadata": {
        "aws:cdk:path": "Alarm-Test/Cloudwatch Alarm 2/Resource"
      }
    },

[NGL321]

From what I can tell in the Gov Cloud docs it doesn't seem like there should be any limitations on this behavior, so its safe to say this is a bug either on our end or with the way the govcloud APIs are handled internally.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.