[hoganbr-amzn]

Issue #, if available: Fixes #4977

Description of changes:

The Task state Resource pattern in data/schemas/other/step_functions/statemachine.json starts with ^arn:aws:, so a Task ARN from any other partition is rejected:

Resources:
  LiteralArn:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: arn:aws-eusc:iam::123456789012:role/sfn
      Definition:
        StartAt: Invoke
        States:
          Invoke:
            Type: Task
            Resource: arn:aws-eusc:lambda:eusc-de-east-1:123456789012:function:worker
            End: true
  SubArn:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/sfn
      Definition:
        StartAt: Invoke
        States:
          Invoke:
            Type: Task
            Resource: !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:worker
            End: true

reports E3601 on LiteralArn on main in every region. SubArn reports W1031 when linted for cn-north-1 or us-gov-west-1, because AWS::Partition resolves to aws-cn or aws-us-gov there.

The pattern now starts with ^arn:aws[A-Za-z\-]*?:, the partition group AwsArn in data/schemas/other/iam/policy.json and E3514's resource ARN pattern already use. The rest of the pattern is unchanged.

Reach. The pattern applies only to Task state Resource values in a Definition or DefinitionString (E3601), including a Ref to a parameter whose default is such an ARN (reported at the default), and to the same values resolved by the resolved-value rules W1031 (Fn::Sub), W1032 (Fn::Join), W1034 (Fn::FindInMap) and W1035 (Fn::Select). It only accepts more values, so it can only remove findings.

Verification.

• New test_state_machine_definition.py cases: Task ARNs in aws-cn and aws-eusc (including a :$LATEST qualifier) are accepted, and an arn:azure: Task ARN is still rejected with the pattern error. The aws-cn/aws-eusc case fails on main. Two existing cases quote the pattern in their expected messages and are updated to the new pattern text.
• The template above: E3601 on LiteralArn on main in every region, and W1031 on SubArn in cn-north-1 and us-gov-west-1. Silent with this change.
• pytest test, pytest -m data test/integration/test_data_file_format.py and pre-commit run --all-files pass.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.74%. Comparing base (632a988) to head (ae400eb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4978   +/-   ##
=======================================
  Coverage   94.74%   94.74%           
=======================================
  Files         441      441           
  Lines       16142    16142           
  Branches     3140     3140           
=======================================
  Hits        15293    15293           
  Misses        469      469           
  Partials      380      380           

Flag	Coverage Δ
unittests	94.73% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.