ARNs use aws as partition

[dscpinheiro]

In some places of the Constructs library, ARNs are built using the string aws as the partition. For instance:

aws-solutions-constructs/source/patterns/@aws-solutions-constructs/aws-kinesisfirehose-s3/lib/index.ts

Lines 95 to 100 in 50d3e9c

	new iam.PolicyStatement({
	actions: [
	'logs:PutLogEvents'
	],
	resources: [`arn:aws:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:log-group:${this.kinesisFirehoseLogGroup.logGroupName}:log-stream:${cwLogStream.logStreamName}`]
	})

aws-solutions-constructs/source/patterns/@aws-solutions-constructs/core/lib/lambda-helper.ts

Line 66 in 2740df7

resources: [`arn:aws:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:log-group:/aws/lambda/*`]

aws-solutions-constructs/source/patterns/@aws-solutions-constructs/core/lib/apigateway-helper.ts

Line 46 in abddeed

resources: [`arn:aws:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:*`]

This can cause problems when deploying to AWS China or AWS GovCloud (US) regions.

Environment

• CDK CLI Version : 1.63.0
• AWS Solutions Constructs Version : 1.63.0

Other

Suggestion is to use the PARTITION property of the Aws class in the CDK:

resources: [`arn:${cdk.Aws.PARTITION}:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:log-group:/aws/lambda/*`]

---

This is 🐛 Bug Report

[hnishar]

This has been fixed in v1.64.0