Repository navigation
fix(persistence): migrate pre-partition arn:aws: ARNs in persisted state - #2627
Merged
Merged
Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 10 files
Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.
Re-trigger cubic
State written before fakecloud minted ARNs in the region's partition spells them arn:aws: even for China, GovCloud and ISO regions, so a cn/gov/iso server restarted on such a data directory mixed partitions in its responses and kept ARN-keyed state (SNS topics, tag maps, ...) under the stale spelling. Before any service loads, a one-time migration now rewrites every ARN token in the persisted state: values, object keys, and ARNs embedded in stored documents (policies, templates, definitions), in place so the document text is otherwise unchanged. A regional ARN whose region belongs to another partition takes that partition; a region-less ARN takes the server region's partition when that is not aws, except AWS-owned ones (managed policies), which fakecloud keeps as arn:aws:. Hash-verified payloads (SQS bodies/attributes, ECR manifests) and bulk payloads (log events, S3 object bodies, container volumes) are left alone. S3 sidecar TOML is covered too. The run is recorded once per directory as arn_partitions_migrated in fakecloud.version.toml; directories created by this binary start with it set, so newer state is never re-migrated. Closes #2610
…igration Review fixes for the one-time ARN partition migration: - Skip filesystem artifacts (lost+found, dotfiles) and service directories the server cannot read instead of failing startup. - Leave customer data verbatim: DynamoDB items and stream images, SSM parameter values, Secrets Manager secrets, and S3 object keys, user metadata and tags (rewriting the key stranded the object in the directory derived from the old key). Object sidecars are rewritten structurally; bucket subresource files hold raw JSON/XML payloads and are rewritten as text. - Rewrite policy wildcards (`arn:aws:kms:*:acct:key/*`) with the resources they match, so stored allows keep matching. - Drop the token-boundary check from the byte pre-check: an ARN behind a serialized escape (`\narn:aws:...`) made a file look clean and it was then marked migrated for good.
…N migration
Second review round on the ARN partition migration:
- Accept `${...}` policy variables and Fn::Sub references in the region
and account fields, so `arn:aws:iam::${aws:PrincipalAccount}:role/x`
moves with the roles it matches; a variable region follows the
server's partition like a wildcard.
- Detect S3 object trees only at `s3/buckets/<bucket>/{objects,mpu}`, so
a bucket named `objects` or `mpu` keeps its configuration rewritten.
- Skip an unreadable file or directory individually instead of
abandoning the rest of its service (or every later S3 bucket).
- Keep EventBridge events and CloudWatch dashboard bodies verbatim: they
are customer payloads measured by a stored size_bytes.
…rbatim Third review round on the ARN partition migration: - A failure writing a migrated file is no longer mistaken for an unreadable path and skipped: the loader would read the stale file and the marker would stop the migration for good. It now fails startup, and the next start retries. - Keep SES sent emails (subject, bodies, raw data, template data, headers: the stored DKIM signature covers them) and SNS published messages (kept like the SQS copies of the same publish) verbatim.
- Accept `?` in the service field like the region and account fields. - Treat a backslash-escape tail (`\narn:aws:...`) as a token start, so the raw-text rewrite of bucket subresource payloads agrees with the byte pre-check instead of leaving a stale ARN behind the marker. - Keep a multipart upload's `tagging` and the client-supplied object headers (Content-Type, Content-Disposition, ...) verbatim, like object tags and user metadata. - Docs: say which S3 metadata is rewritten and which fields are kept.
vieiralucas
force-pushed
the
fix/issue-2610
branch
from
October 1, 2026 06:49
da366ee to
551e581
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #2610.
State persisted by a cn/gov/iso-region server before the ARN partition work (#2569..#2591) still held
arn:aws:.... A one-time, load-time migration now rewrites it.fakecloud_persistence::arn_partition::migrate_data_dir(data_path, region)runs inmain.rsright after the version-file check, before any service loads, then setsarn_partitions_migrated = trueinfakecloud.version.toml(new data dirs start with it set). A single marker instead of ~100 per-service schema bumps; old binaries ignore the field. Files are replaced atomically and the marker is written last, so an interrupted run re-runs idempotently.arn:aws:<svc>:<region>:...) take their region's partition whatever--regionis (anarn:aws:ARN with a cn/gov/iso region can't be valid). Region-less ARNs (arn:aws:iam::...,arn:aws:s3:::...) take the server's partition, only when it isn'taws. AWS-managed policies (arn:aws:iam::aws:policy/...) stay as is, matching the managed-policy catalog lookup. Wildcards (*,?) and${...}variables move with the resources they match; region patterns follow the server's partition.<service>/*.jsonandlogs/manifest.json, plus S3 bucket subresource files and object/multipart sidecars. A byte pre-scan skips files with nothing to fix, so commercial servers pay one scan.lost+found) are skipped individually; a failed write aborts startup so the marker is never set over stale state.fakecloud-persistencenow depends onfakecloud-aws(moved to layer 2 inscripts/publish-crates.sh;--checkpasses).Edge cases (accepted): an
aws-partition server still rewrites regional ARNs naming a cn/gov/iso region and sets the marker; no-marker dirs written by current main are treated as legacy (an IAM entity created on a cn server through a us-east-1-signed request would becomeaws-cn; indistinguishable); a migrated map key colliding with an existing new-partition key keeps the existing one and logs a warning.Surfaces: new "ARN partition migration" section in
docs/reference/persistence.md. No CLI/SDK change.Test plan
arn_partition_tests.rs(rewriter rules, keys/values/documents, wildcards and variables, managed policies, idempotence, full data-dir runs, marker, regression test per review finding); persistence crate 97.arn_partition_migration_persistence.rs: us-east-1 server creates KMS/SNS/IAM/SQS/S3/Lambda/DynamoDB state, snapshots rewritten tocn-north-1with the marker stripped (realistic legacy dir), restart with--region cn-north-1->arn:aws-cn:from KMS DescribeKey/ListAliases (lookup by new ARN and alias), SNS ListTopics/GetTopicAttributes alongside a new topic, IAM GetRole + trust/inline docs + attached customer policies (managed policy stillarn:aws:), SQS QueueArn + RedrivePolicy (body + MD5 unchanged), S3 bucket policy + object SSE-KMS key ARN (ARN-like key still reachable), DynamoDB DescribeTable, Lambda GetFunction, marker set. Fails with the migration disabled.*_persistencee2e suites (139 tests).publish-crates.sh --check; local /code-review medium 4 rounds, last clean (fixed 11 findings incl. lost+found abort, stranded S3 objects, customer-data rewrites, wildcards/variables, escaped-ARN pre-scan miss, write errors marked migrated).Summary by cubic
Migrates
arn:aws:ARNs in persisted state to their region's partition, so a China, GovCloud, or ISO-region server restarted on older state stops mixing partitions and its ARN-keyed lookups (SNS topics, tag maps) work again.arn_partitions_migrated = trueinfakecloud.version.toml; new directories start with the marker, and an interrupted run re-runs idempotently.--regionis; ARNs without a region take the server's partition when it isn'taws, while AWS-managed policy ARNs keep theawsspelling to match the managed-policy catalog. Wildcards (*,?) and${...}variables move with the resources they match.\narn:aws:...) in raw JSON/XML still count.Written for commit 551e581. Summary will update on new commits.