[hoganbr-amzn]

Issue #, if available: Fixes #4975

Description of changes:

The principal ARN patterns allow only the aws, aws-cn and aws-us-gov partitions: AwsPrincipalArn in data/schemas/other/iam/policy.json, and TrustAwsPrincipalArn in data/schemas/other/iam/policy_trust.json. AwsArn in policy.json accepts any aws* partition. A principal from any other partition is rejected:

Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws-eusc:iam::123456789012:root
            Action: sts:AssumeRole

reports E3530 on main. The same principal reports E3512 in an AWS::S3::BucketPolicy and E3513 in an AWS::ECR::Repository RepositoryPolicyText.

The principal patterns in both definitions (iam::<account>:..., sts::<account>:assumed-role|root|federated-user, iam::cloudfront:user/) now use the aws[A-Za-z\-]*? partition group from AwsArn. They leave out AwsArn's * alternative, which is not a valid principal partition. Only the partition group changes; the rest of each pattern, including the trust schema's exclusion of group ARNs, is unchanged.

Reach.

• TrustAwsPrincipalArn is used only by the trust policy schema's Principal (E3530).
• AwsPrincipalArn is used only by the Principal definition in policy.json. A statement's Principal and NotPrincipal both reference that definition, and so do the resource (E3512) and ECR repository (E3513) policy schemas.
• The identity policy schema (E3510) forbids Principal, so it is unaffected.

The patterns only accept more values, so the change can only remove findings.

Verification.

• test_valid_trust_policy_every_partition (E3530) checks root, role, and sts assumed-role, root and federated-user principals in every partition. test_principal_every_partition (E3512) checks a bucket policy with aws-eusc root, role and assumed-role principals. Both fail on main. test_invalid_trust_policy_non_aws_partition checks that arn:azure:iam::123456789012:root is still rejected.
• Good fixtures linted one region at a time, one region from each partition in cfn-lint's region list (cfn-lint --format parseable --regions <region> -t "test/fixtures/templates/good/**/*.yaml" "test/fixtures/templates/good/**/*.json"): same output as main, apart from the pattern text quoted in an E3530 message that good/functions/sub_needed_custom_excludes.yaml already gets on main.
• pytest test and pre-commit run --all-files pass.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.74%. Comparing base (632a988) to head (6a91e86).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4976   +/-   ##
=======================================
  Coverage   94.74%   94.74%           
=======================================
  Files         441      441           
  Lines       16142    16142           
  Branches     3140     3140           
=======================================
  Hits        15293    15293           
  Misses        469      469           
  Partials      380      380           

Flag	Coverage Δ
unittests	94.73% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.