From 12feedfbd216ae4e69c8a109aabbc5419f9b74e3 Mon Sep 17 00:00:00 2001
From: Thuan Vo <thvo@redhat.com>
Date: Fri, 24 Jul 2026 13:47:22 -0700
Subject: [PATCH] OCPBUGS-99755: fix AWS endpoint resolution for non-standard
 partitions

The BaseEndpoint for ELBv2 and EC2 clients was hardcoded to
.amazonaws.com, which is incorrect for non-standard AWS partitions
like EUSC (.amazonaws.eu). This caused API calls to fail on EUSC
clusters because the requests were sent to the wrong domain.

Use partition-aware DNS suffix resolution instead of hardcoding
.amazonaws.com, so that all AWS partitions (EUSC, China, GovCloud,
ISO, etc.) resolve to the correct public regional endpoint.
---
 .../ccm-aws-tests/e2e/aws/helper.go           | 27 +++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/openshift-tests/ccm-aws-tests/e2e/aws/helper.go b/openshift-tests/ccm-aws-tests/e2e/aws/helper.go
index cbb84fb74..7c5d87571 100644
--- a/openshift-tests/ccm-aws-tests/e2e/aws/helper.go
+++ b/openshift-tests/ccm-aws-tests/e2e/aws/helper.go
@@ -61,7 +61,7 @@ func createAWSClientLoadBalancer(ctx context.Context) (*elbv2.Client, error) {
 		o.Retryer = customRetryer
 		// Use regional public endpoints to prevent malformed or unreachable
 		// (from test binary, which usually runs outside cluster's VPC) endpoints.
-		o.BaseEndpoint = aws.String(fmt.Sprintf("https://elasticloadbalancing.%s.amazonaws.com", cfg.Region))
+		o.BaseEndpoint = aws.String(fmt.Sprintf("https://elasticloadbalancing.%s.%s", cfg.Region, dnsSuffixForRegion(cfg.Region)))
 	}), nil
 }
 
@@ -139,7 +139,7 @@ func createAWSClientEC2(ctx context.Context) (*ec2.Client, error) {
 	return ec2.NewFromConfig(cfg, func(o *ec2.Options) {
 		// Use regional public endpoints to prevent malformed or unreachable
 		// (from test binary, which usually runs outside cluster's VPC) endpoints.
-		o.BaseEndpoint = aws.String(fmt.Sprintf("https://ec2.%s.amazonaws.com", cfg.Region))
+		o.BaseEndpoint = aws.String(fmt.Sprintf("https://ec2.%s.%s", cfg.Region, dnsSuffixForRegion(cfg.Region)))
 	}), nil
 }
 
@@ -197,6 +197,29 @@ func securityGroupExists(ctx context.Context, ec2Client *ec2.Client, sgID string
 	return true, nil
 }
 
+// dnsSuffixForRegion returns the DNS suffix for the AWS partition that the given region resides in.
+// This is needed when constructing explicit public regional endpoints so that non-standard partitions
+// like EUSC (.amazonaws.eu) are handled correctly instead of assuming suffix .amazonaws.com.
+// Reference: https://github.com/aws/aws-sdk-go-v2/blob/main/internal/endpoints/awsrulesfn/partitions.go
+func dnsSuffixForRegion(region string) string {
+	switch {
+	case strings.HasPrefix(region, "cn-"):
+		return "amazonaws.com.cn"
+	case strings.HasPrefix(region, "eusc-"):
+		return "amazonaws.eu"
+	case strings.HasPrefix(region, "us-iso-"):
+		return "c2s.ic.gov"
+	case strings.HasPrefix(region, "us-isob-"):
+		return "sc2s.sgov.gov"
+	case strings.HasPrefix(region, "eu-isoe-"):
+		return "cloud.adc-e.uk"
+	case strings.HasPrefix(region, "us-isof-"):
+		return "csp.hci.ic.gov"
+	default:
+		return "amazonaws.com"
+	}
+}
+
 // ec2IsNotFoundError checks if an error is an EC2 "not found" error.
 func ec2IsNotFoundError(err error) bool {
 	if err == nil {