validateArn incorrectly rejects ARNs in isolated AWS regions

[ccday]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.13

• provider.aws v2.6.0

Affected Resource(s)

• All resources that have a field that uses validateArn for validation

Terraform Configuration Files

resource "aws_ebs_volume" "test" {
  // Some configuration...

  encrypted = true
  kms_key_id = "arn:aws-iso:kms:us-iso-east-1:012345678901:key/some-uuid-abc123"
}

Expected Behavior

The ARN should validate.

Actual Behavior

The ARN does not validate:

aws_ebs_volume.test: "kms_key_id" doesn't look like a valid ARN ("^arn:[\\w-]+:([a-zA-Z0-9\\-])+:([a-z]{2}-(gov-)?[a-z]+-\\d{1})?:(\\d{12})?:(.*)$"): <arn here>

Suggested fix is to update the regex in the validateArn function of aws/validators.go to match on ARNs from the iso and isob partitions:

pattern := `^arn:[\w-]+:([a-zA-Z0-9\-])+:([a-z]{2}-((?:gov|iso|isob)-)?[a-z]+-\d{1})?:(\d{12})?:(.*)$`

Steps to Reproduce

1. Create a configuration that uses an ARN from an isolated AWS region.
2. terraform validate

Important Factoids

This account is located in an isolated AWS region.

[ccday]

I'd be happy to make a PR with a fix for this issue - let me know if the suggested fix sounds good.

[ewbankkit]

Related:

• Support AWS C2S and SC2S Endpoints #9993

[ewbankkit]

Probably most sustainable is to use the AWS SDK's arn.Parse method.
It doesn't validate quite as extensively the regex but its the regex that is brittle and it will certainly catch the most common types of errors which are probably usage of a resource ID or name instead of an ARN.

[ewbankkit]

Similar:

• func ValidateARN regex check needs to support additional regions #11444

[bflad]

The fix for this has been merged and will release with version 2.44.0 of the Terraform AWS Provider, on Thursday. 👍

[ghost]

This has been released in version 2.44.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!