fix(custom-resource-handler): remove hardcoded partition in s3 auto-delete-objects handler

[Khangdang1690]

Issue # (if applicable)

Closes #33212.

Reason for this change

The auto-delete-objects custom resource Lambda hardcodes arn:aws:s3:::${bucketName}/* when attaching the pre-delete s3:PutObject deny policy. The literal aws partition silently breaks the deny policy in aws-cn (China) and aws-us-gov (GovCloud), where bucket ARNs are arn:aws-cn:... / arn:aws-us-gov:.... The s3:PutObject deny statement is non-fatal (the bucket still gets emptied), so the issue is silent — the race-condition protection against external writers is simply absent in non-default partitions.

The CDK team filed this themselves when the @cdklabs/no-literal-partition lint rule flagged the line; an inline eslint-disable was added with a TODO at the time.

Description of changes

The handler now derives the partition at runtime from event.ServiceToken, which CloudFormation always populates with the Lambda's own ARN. Since the Lambda is always provisioned in the same partition as the bucket it manages, this is the correct partition to use in the deny ARN. The eslint suppression and TODO are removed.

async function denyWrites(bucketName: string, serviceToken: string) {
  // ServiceToken is this Lambda's ARN — same partition as the bucket.
  const partition = serviceToken.split(':')[1];
  // ...
  Resource: [`arn:${partition}:s3:::${bucketName}/*`],
}

Alternative considered and rejected: passing the partition to the handler as a Lambda environment variable populated from Stack.of(scope).partition at synth time. That works but adds a new Environment.Variables entry to the provider Lambda in every stack with autoDeleteObjects: true, which would regenerate ~100 integration test snapshots across the framework-integ package. The event.ServiceToken approach delivers the same correctness with zero synthesized-template changes.

Describe any new or updated permissions being added

None.

Description of how you validated changes

• Updated existing unit tests for Delete events to provide a top-level ServiceToken ARN (the canonical CloudFormation custom-resource field) so they continue to assert on the existing arn:aws:s3:::MyBucket/* deny ARN.
• Added a new unit test 'deny policy ARN uses the partition from the ServiceToken (aws-cn)' that fires a Delete event with an arn:aws-cn:... ServiceToken and asserts the resulting deny statement uses arn:aws-cn:s3:::MyBucket/*.
• All 16 tests pass (15 existing + 1 new) via yarn test in packages/@aws-cdk/custom-resource-handlers.
• No integration test snapshots are affected by this change (no construct-side modifications, no env var added to the Lambda).

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[Khangdang1690]

Exemption Request

This is a runtime-only fix in @aws-cdk/custom-resource-handlers/lib/aws-s3/auto-delete-objects-handler/index.ts. There are no construct-side changes, so the synthesized CloudFormation template is unchanged in the aws (commercial) partition.

The bug only manifests in aws-cn (China) and aws-us-gov (GovCloud), where bucket ARNs use arn:aws-cn:... / arn:aws-us-gov:.... CDK integ tests run only in the commercial partition, where Stack.of(scope).partition === 'aws' — the deny policy ARN before this fix (arn:aws:s3:::${bucketName}/*) and after this fix (arn:${partition}:s3:::${bucketName}/* with partition === 'aws') are byte-identical. An integ test in aws cannot distinguish broken from fixed behavior.

The fix is covered by a new unit test in auto-delete-objects-handler.test.ts ('deny policy ARN uses the partition from the ServiceToken (aws-cn)'), which fires a synthetic Delete event with a ServiceToken in the aws-cn partition and asserts the resulting deny policy is arn:aws-cn:s3:::MyBucket/*. This is the only level at which the fix is observable.

If a reviewer can suggest a way to exercise non-aws partition behavior in the existing integ test infrastructure, happy to add one. Otherwise the unit test is the strongest available verification.