bug: ARN validation too restrictive

[fox91]

🐛 AWS Backup Provider Bug

AWS Provider Version: 0.28.0-1.1.0

Bug Description

From 8d7d735 regex that validate input are too restrictive.
For example, these ARNs are not considered valid:

• arn:aws:ec2:*:*:instance/*
• arn:aws-us-gov:s3:::*

But they are valid following AWS guide (and it works fine in previous version of this module).

[lgallard]

@claude Let's address this issue

[claude]

Claude finished @lgallard's task —— View job • claude/issue-261-20250908-1015 • Create PR ➔

---

✅ Fixed ARN validation issue

Todo List

• Examine commit 8d7d735 to understand what validation was changed
• Find ARN validation code in the codebase
• Analyze current regex patterns and identify the restrictive parts
• Fix regex to allow valid AWS ARN patterns (wildcards, gov cloud)
• Test with the provided ARN examples
• Run linting/validation if available
• Commit and push changes

Problem Analysis

Found the restrictive ARN validation in variables.tf at lines 571-578. The regex patterns were too strict and didn't follow the AWS ARN specification.

Fix Applied

Updated all ARN regex patterns in the backup_selections variable validation to support:

✅ AWS Partitions: aws, aws-us-gov, aws-cn using arn:aws(-[a-z-]+)?:
✅ Wildcards: Allow * in regions, accounts, and resource IDs
✅ Backward Compatibility: All existing ARNs continue to work

Verification

Both problematic ARNs from the issue now work:

• arn:aws:ec2:*:*:instance/* ✅ Matches updated EC2 pattern
• arn:aws-us-gov:s3:::* ✅ Matches updated S3 pattern

Changes Made

Before: ^arn:aws:ec2:[a-z0-9-]+:[0-9]+:(volume|instance)/[a-zA-Z0-9-]+$
After: ^arn:aws(-[a-z-]+)?:ec2:([a-z0-9-]+|\\*):([0-9]+|\\*):(volume|instance)/([a-zA-Z0-9-]+|\\*)$

Similar updates applied to all service patterns (DynamoDB, RDS, EFS, FSx, S3, Storage Gateway).

---

[lgallard]

@fox91 thanks for reporting the issue. It was addressed and released. Let me know if you find any other issues!