Update AWS provider/module and generated content

bendrucker · github-actions[bot] · commit 52af729fe24b · 2025-11-24T01:47:37.000Z
diff --git a/rules/ephemeral/ephemeral_resources_gen.go b/rules/ephemeral/ephemeral_resources_gen.go
@@ -3,6 +3,7 @@
 package ephemeral
 
 var replacingEphemeralResources = []string{
+		"aws_ecr_authorization_token",
 		"aws_eks_cluster_auth",
 		"aws_kms_secrets",
 		"aws_lambda_invocation",
diff --git a/rules/models/api-models-aws b/rules/models/api-models-aws
@@ -1 +1 @@
-Subproject commit 37191a6a09ea18c996cc10b45082f755b8d46470
+Subproject commit 4a42b7541555c319381d97111a018a252d52a1a8
diff --git a/rules/models/aws_datasync_location_efs_invalid_efs_file_system_arn.go b/rules/models/aws_datasync_location_efs_invalid_efs_file_system_arn.go
@@ -27,7 +27,7 @@ func NewAwsDatasyncLocationEfsInvalidEfsFileSystemArnRule() *AwsDatasyncLocation
 		resourceType:  "aws_datasync_location_efs",
 		attributeName: "efs_file_system_arn",
 		max:           128,
-		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):elasticfilesystem:[a-z\-0-9]*:[0-9]{12}:file-system/fs-.*$`),
+		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):elasticfilesystem:[a-z\-0-9]+:[0-9]{12}:file-system/fs-[0-9a-f]{8,40}$`),
 	}
 }
 
@@ -81,7 +81,7 @@ func (r *AwsDatasyncLocationEfsInvalidEfsFileSystemArnRule) Check(runner tflint.
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):elasticfilesystem:[a-z\-0-9]*:[0-9]{12}:file-system/fs-.*$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):elasticfilesystem:[a-z\-0-9]+:[0-9]{12}:file-system/fs-[0-9a-f]{8,40}$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_datasync_location_efs_invalid_efs_file_system_arn_test.go b/rules/models/aws_datasync_location_efs_invalid_efs_file_system_arn_test.go
@@ -24,7 +24,7 @@ resource "aws_datasync_location_efs" "foo" {
 			Expected: helper.Issues{
 				{
 					Rule:    NewAwsDatasyncLocationEfsInvalidEfsFileSystemArnRule(),
-					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:eks:us-east-1:123456789012:cluster/my-cluster"), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):elasticfilesystem:[a-z\-0-9]*:[0-9]{12}:file-system/fs-.*$`),
+					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:eks:us-east-1:123456789012:cluster/my-cluster"), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):elasticfilesystem:[a-z\-0-9]+:[0-9]{12}:file-system/fs-[0-9a-f]{8,40}$`),
 				},
 			},
 		},
diff --git a/rules/models/aws_datasync_location_fsx_windows_file_system_invalid_fsx_filesystem_arn.go b/rules/models/aws_datasync_location_fsx_windows_file_system_invalid_fsx_filesystem_arn.go
@@ -27,7 +27,7 @@ func NewAwsDatasyncLocationFsxWindowsFileSystemInvalidFsxFilesystemArnRule() *Aw
 		resourceType:  "aws_datasync_location_fsx_windows_file_system",
 		attributeName: "fsx_filesystem_arn",
 		max:           128,
-		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):fsx:[a-z\-0-9]*:[0-9]{12}:file-system/fs-.*$`),
+		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):fsx:[a-z\-0-9]+:[0-9]{12}:file-system/fs-[0-9a-f]+$`),
 	}
 }
 
@@ -81,7 +81,7 @@ func (r *AwsDatasyncLocationFsxWindowsFileSystemInvalidFsxFilesystemArnRule) Che
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):fsx:[a-z\-0-9]*:[0-9]{12}:file-system/fs-.*$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):fsx:[a-z\-0-9]+:[0-9]{12}:file-system/fs-[0-9a-f]+$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_datasync_location_s3_invalid_s3_bucket_arn.go b/rules/models/aws_datasync_location_s3_invalid_s3_bucket_arn.go
@@ -27,7 +27,7 @@ func NewAwsDatasyncLocationS3InvalidS3BucketArnRule() *AwsDatasyncLocationS3Inva
 		resourceType:  "aws_datasync_location_s3",
 		attributeName: "s3_bucket_arn",
 		max:           268,
-		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3:[a-z\-0-9]*:[0-9]{12}:accesspoint[/:][a-zA-Z0-9\-.]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3-outposts:[a-z\-0-9]+:[0-9]{12}:outpost[/:][a-zA-Z0-9\-]{1,63}[/:]accesspoint[/:][a-zA-Z0-9\-]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3:::[a-zA-Z0-9.\-_]{1,255}$`),
+		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3:[a-z\-0-9]*:[0-9]{12}:accesspoint[/:][a-zA-Z0-9\-.]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3-outposts:[a-z\-0-9]+:[0-9]{12}:outpost[/:][a-zA-Z0-9\-]{1,63}[/:]accesspoint[/:][a-zA-Z0-9\-]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3:::[a-zA-Z0-9.\-_]{1,255}$`),
 	}
 }
 
@@ -81,7 +81,7 @@ func (r *AwsDatasyncLocationS3InvalidS3BucketArnRule) Check(runner tflint.Runner
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3:[a-z\-0-9]*:[0-9]{12}:accesspoint[/:][a-zA-Z0-9\-.]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3-outposts:[a-z\-0-9]+:[0-9]{12}:outpost[/:][a-zA-Z0-9\-]{1,63}[/:]accesspoint[/:][a-zA-Z0-9\-]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3:::[a-zA-Z0-9.\-_]{1,255}$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3:[a-z\-0-9]*:[0-9]{12}:accesspoint[/:][a-zA-Z0-9\-.]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3-outposts:[a-z\-0-9]+:[0-9]{12}:outpost[/:][a-zA-Z0-9\-]{1,63}[/:]accesspoint[/:][a-zA-Z0-9\-]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3:::[a-zA-Z0-9.\-_]{1,255}$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_datasync_location_s3_invalid_s3_bucket_arn_test.go b/rules/models/aws_datasync_location_s3_invalid_s3_bucket_arn_test.go
@@ -24,7 +24,7 @@ resource "aws_datasync_location_s3" "foo" {
 			Expected: helper.Issues{
 				{
 					Rule:    NewAwsDatasyncLocationS3InvalidS3BucketArnRule(),
-					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:eks:us-east-1:123456789012:cluster/my-cluster"), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3:[a-z\-0-9]*:[0-9]{12}:accesspoint[/:][a-zA-Z0-9\-.]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3-outposts:[a-z\-0-9]+:[0-9]{12}:outpost[/:][a-zA-Z0-9\-]{1,63}[/:]accesspoint[/:][a-zA-Z0-9\-]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):s3:::[a-zA-Z0-9.\-_]{1,255}$`),
+					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:eks:us-east-1:123456789012:cluster/my-cluster"), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3:[a-z\-0-9]*:[0-9]{12}:accesspoint[/:][a-zA-Z0-9\-.]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3-outposts:[a-z\-0-9]+:[0-9]{12}:outpost[/:][a-zA-Z0-9\-]{1,63}[/:]accesspoint[/:][a-zA-Z0-9\-]{1,63}$|^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):s3:::[a-zA-Z0-9.\-_]{1,255}$`),
 				},
 			},
 		},
diff --git a/rules/models/aws_datasync_task_invalid_cloudwatch_log_group_arn.go b/rules/models/aws_datasync_task_invalid_cloudwatch_log_group_arn.go
@@ -27,7 +27,7 @@ func NewAwsDatasyncTaskInvalidCloudwatchLogGroupArnRule() *AwsDatasyncTaskInvali
 		resourceType:  "aws_datasync_task",
 		attributeName: "cloudwatch_log_group_arn",
 		max:           562,
-		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\*]*)(:\*)?$`),
+		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\*]*)(:\*)?$`),
 	}
 }
 
@@ -81,7 +81,7 @@ func (r *AwsDatasyncTaskInvalidCloudwatchLogGroupArnRule) Check(runner tflint.Ru
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\*]*)(:\*)?$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\*]*)(:\*)?$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_datasync_task_invalid_cloudwatch_log_group_arn_test.go b/rules/models/aws_datasync_task_invalid_cloudwatch_log_group_arn_test.go
@@ -24,7 +24,7 @@ resource "aws_datasync_task" "foo" {
 			Expected: helper.Issues{
 				{
 					Rule:    NewAwsDatasyncTaskInvalidCloudwatchLogGroupArnRule(),
-					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:s3:::my_corporate_bucket"), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\*]*)(:\*)?$`),
+					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:s3:::my_corporate_bucket"), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\*]*)(:\*)?$`),
 				},
 			},
 		},
diff --git a/rules/models/aws_datasync_task_invalid_destination_location_arn.go b/rules/models/aws_datasync_task_invalid_destination_location_arn.go
@@ -27,7 +27,7 @@ func NewAwsDatasyncTaskInvalidDestinationLocationArnRule() *AwsDatasyncTaskInval
 		resourceType:  "aws_datasync_task",
 		attributeName: "destination_location_arn",
 		max:           128,
-		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
+		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
 	}
 }
 
@@ -81,7 +81,7 @@ func (r *AwsDatasyncTaskInvalidDestinationLocationArnRule) Check(runner tflint.R
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_datasync_task_invalid_source_location_arn.go b/rules/models/aws_datasync_task_invalid_source_location_arn.go
@@ -27,7 +27,7 @@ func NewAwsDatasyncTaskInvalidSourceLocationArnRule() *AwsDatasyncTaskInvalidSou
 		resourceType:  "aws_datasync_task",
 		attributeName: "source_location_arn",
 		max:           128,
-		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
+		pattern:       regexp.MustCompile(`^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
 	}
 }
 
@@ -81,7 +81,7 @@ func (r *AwsDatasyncTaskInvalidSourceLocationArnRule) Check(runner tflint.Runner
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_datasync_task_invalid_source_location_arn_test.go b/rules/models/aws_datasync_task_invalid_source_location_arn_test.go
@@ -24,7 +24,7 @@ resource "aws_datasync_task" "foo" {
 			Expected: helper.Issues{
 				{
 					Rule:    NewAwsDatasyncTaskInvalidSourceLocationArnRule(),
-					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:datasync:us-east-2:111222333444:task/task-08de6e6697796f026"), `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
+					Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:datasync:us-east-2:111222333444:task/task-08de6e6697796f026"), `^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$`),
 				},
 			},
 		},
diff --git a/rules/models/aws_imagebuilder_image_invalid_image_recipe_arn.go b/rules/models/aws_imagebuilder_image_invalid_image_recipe_arn.go
@@ -25,7 +25,7 @@ func NewAwsImagebuilderImageInvalidImageRecipeArnRule() *AwsImagebuilderImageInv
 	return &AwsImagebuilderImageInvalidImageRecipeArnRule{
 		resourceType:  "aws_imagebuilder_image",
 		attributeName: "image_recipe_arn",
-		pattern:       regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:[0-9]{12}|aws):image-recipe/[a-z0-9-_]+/[0-9]+\.[0-9]+\.[0-9]+$`),
+		pattern:       regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:[0-9]{12}|aws):image-recipe/[a-z0-9-_]+/(?:[0-9]+|x)\.(?:[0-9]+|x)\.(?:[0-9]+|x)$`),
 	}
 }
 
@@ -72,7 +72,7 @@ func (r *AwsImagebuilderImageInvalidImageRecipeArnRule) Check(runner tflint.Runn
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:aws[^:]*:imagebuilder:[^:]+:(?:[0-9]{12}|aws):image-recipe/[a-z0-9-_]+/[0-9]+\.[0-9]+\.[0-9]+$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:aws[^:]*:imagebuilder:[^:]+:(?:[0-9]{12}|aws):image-recipe/[a-z0-9-_]+/(?:[0-9]+|x)\.(?:[0-9]+|x)\.(?:[0-9]+|x)$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_imagebuilder_image_pipeline_invalid_image_recipe_arn.go b/rules/models/aws_imagebuilder_image_pipeline_invalid_image_recipe_arn.go
@@ -25,7 +25,7 @@ func NewAwsImagebuilderImagePipelineInvalidImageRecipeArnRule() *AwsImagebuilder
 	return &AwsImagebuilderImagePipelineInvalidImageRecipeArnRule{
 		resourceType:  "aws_imagebuilder_image_pipeline",
 		attributeName: "image_recipe_arn",
-		pattern:       regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:[0-9]{12}|aws):image-recipe/[a-z0-9-_]+/[0-9]+\.[0-9]+\.[0-9]+$`),
+		pattern:       regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:[0-9]{12}|aws):image-recipe/[a-z0-9-_]+/(?:[0-9]+|x)\.(?:[0-9]+|x)\.(?:[0-9]+|x)$`),
 	}
 }
 
@@ -72,7 +72,7 @@ func (r *AwsImagebuilderImagePipelineInvalidImageRecipeArnRule) Check(runner tfl
 			if !r.pattern.MatchString(val) {
 				runner.EmitIssue(
 					r,
-					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:aws[^:]*:imagebuilder:[^:]+:(?:[0-9]{12}|aws):image-recipe/[a-z0-9-_]+/[0-9]+\.[0-9]+\.[0-9]+$`),
+					fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:aws[^:]*:imagebuilder:[^:]+:(?:[0-9]{12}|aws):image-recipe/[a-z0-9-_]+/(?:[0-9]+|x)\.(?:[0-9]+|x)\.(?:[0-9]+|x)$`),
 					attribute.Expr.Range(),
 				)
 			}
diff --git a/rules/models/aws_organizations_policy_invalid_type.go b/rules/models/aws_organizations_policy_invalid_type.go
@@ -29,10 +29,12 @@ func NewAwsOrganizationsPolicyInvalidTypeRule() *AwsOrganizationsPolicyInvalidTy
 			"BACKUP_POLICY",
 			"CHATBOT_POLICY",
 			"DECLARATIVE_POLICY_EC2",
+			"INSPECTOR_POLICY",
 			"RESOURCE_CONTROL_POLICY",
 			"SECURITYHUB_POLICY",
 			"SERVICE_CONTROL_POLICY",
 			"TAG_POLICY",
+			"UPGRADE_ROLLOUT_POLICY",
 		},
 	}
 }
diff --git a/rules/models/aws_vpc_ipam_pool_invalid_aws_service.go b/rules/models/aws_vpc_ipam_pool_invalid_aws_service.go
@@ -26,6 +26,7 @@ func NewAwsVpcIpamPoolInvalidAwsServiceRule() *AwsVpcIpamPoolInvalidAwsServiceRu
 		attributeName: "aws_service",
 		enum: []string{
 			"ec2",
+			"global-services",
 		},
 	}
 }
diff --git a/rules/tags/resources.go b/rules/tags/resources.go
diff --git a/tools/provider-schema/.terraform.lock.hcl b/tools/provider-schema/.terraform.lock.hcl
diff --git a/tools/provider-schema/schema.json b/tools/provider-schema/schema.json

Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ func NewAwsDatasyncLocationEfsInvalidEfsFileSystemArnRule() *AwsDatasyncLocation`
`27`	`27`	`resourceType: "aws_datasync_location_efs",`
`28`	`28`	`attributeName: "efs_file_system_arn",`
`29`	`29`	`max: 128,`
`30`		- pattern: regexp.MustCompile(`^arn:(aws\|aws-cn\|aws-us-gov\|aws-iso\|aws-iso-b):elasticfilesystem:[a-z\-0-9]:[0-9]{12}:file-system/fs-.$`),
	`30`	+ pattern: regexp.MustCompile(`^arn:(aws\|aws-cn\|aws-us-gov\|aws-eusc\|aws-iso\|aws-iso-b):elasticfilesystem:[a-z\-0-9]+:[0-9]{12}:file-system/fs-[0-9a-f]{8,40}$`),
`31`	`31`	`}`
`32`	`32`	`}`
`33`	`33`
`@@ -81,7 +81,7 @@ func (r *AwsDatasyncLocationEfsInvalidEfsFileSystemArnRule) Check(runner tflint.`
`81`	`81`	`if !r.pattern.MatchString(val) {`
`82`	`82`	`runner.EmitIssue(`
`83`	`83`	`r,`
`84`		- fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws\|aws-cn\|aws-us-gov\|aws-iso\|aws-iso-b):elasticfilesystem:[a-z\-0-9]:[0-9]{12}:file-system/fs-.$`),
	`84`	+ fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws\|aws-cn\|aws-us-gov\|aws-eusc\|aws-iso\|aws-iso-b):elasticfilesystem:[a-z\-0-9]+:[0-9]{12}:file-system/fs-[0-9a-f]{8,40}$`),
`85`	`85`	`attribute.Expr.Range(),`
`86`	`86`	`)`
`87`	`87`	`}`
Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@ resource "aws_datasync_location_efs" "foo" {`
`24`	`24`	`Expected: helper.Issues{`
`25`	`25`	`{`
`26`	`26`	`Rule: NewAwsDatasyncLocationEfsInvalidEfsFileSystemArnRule(),`
`27`		- Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:eks:us-east-1:123456789012:cluster/my-cluster"), `^arn:(aws\|aws-cn\|aws-us-gov\|aws-iso\|aws-iso-b):elasticfilesystem:[a-z\-0-9]:[0-9]{12}:file-system/fs-.$`),
	`27`	+ Message: fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage("arn:aws:eks:us-east-1:123456789012:cluster/my-cluster"), `^arn:(aws\|aws-cn\|aws-us-gov\|aws-eusc\|aws-iso\|aws-iso-b):elasticfilesystem:[a-z\-0-9]+:[0-9]{12}:file-system/fs-[0-9a-f]{8,40}$`),
`28`	`28`	`},`
`29`	`29`	`},`
`30`	`30`	`},`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ func NewAwsDatasyncTaskInvalidCloudwatchLogGroupArnRule() *AwsDatasyncTaskInvali`
`27`	`27`	`resourceType: "aws_datasync_task",`
`28`	`28`	`attributeName: "cloudwatch_log_group_arn",`
`29`	`29`	`max: 562,`
`30`		- pattern: regexp.MustCompile(`^arn:(aws\|aws-cn\|aws-us-gov\|aws-iso\|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\])(:\*)?$`),
	`30`	+ pattern: regexp.MustCompile(`^arn:(aws\|aws-cn\|aws-us-gov\|aws-eusc\|aws-iso\|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\])(:\*)?$`),
`31`	`31`	`}`
`32`	`32`	`}`
`33`	`33`
`@@ -81,7 +81,7 @@ func (r *AwsDatasyncTaskInvalidCloudwatchLogGroupArnRule) Check(runner tflint.Ru`
`81`	`81`	`if !r.pattern.MatchString(val) {`
`82`	`82`	`runner.EmitIssue(`
`83`	`83`	`r,`
`84`		- fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws\|aws-cn\|aws-us-gov\|aws-iso\|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\])(:\*)?$`),
	`84`	+ fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:(aws\|aws-cn\|aws-us-gov\|aws-eusc\|aws-iso\|aws-iso-b):logs:[a-z\-0-9]+:[0-9]{12}:log-group:([^:\])(:\*)?$`),
`85`	`85`	`attribute.Expr.Range(),`
`86`	`86`	`)`
`87`	`87`	`}`