Fix S3 Control operations for S3 Express Directory Buckets

[christophersherman]

Description

Fixes S3 Express Directory Bucket operations that were failing with 403 Forbidden errors due to incorrect API endpoint routing across all S3 Control resources.

Problem: When performing operations on S3 Directory Bucket resources (access points, policies, lifecycle configurations), the provider was incorrectly routing requests to the standard S3 Control API endpoint (s3-control.amazonaws.com) instead of the required endpoints for Directory Buckets. This particularly affected tagging operations which require the S3 Express Control API endpoint (s3express-control.region.amazonaws.com).

Error encountered:

Error: listing tags for S3 (Simple Storage) Directory Bucket operation error 
S3 Control: ListTagsForResource, https response error StatusCode: 403, 
RequestID: ..., api error UnknownError: UnknownError

Despite having the correct IAM permissions (s3express:ListTagsForResource), and also (s3:ListTagsForResource) operations failed because requests were sent to the wrong API endpoint.

Solution:

• Added S3ExpressControlClient() method to AWSClient that uses the correct s3express-control.region.amazonaws.com endpoint for Directory Bucket tagging operations
• Updated all S3 Control resource operations to properly handle Directory Bucket ARNs (containing :s3express:)
• For tagging operations: routes to the specialized S3 Express Control endpoint
• For other operations: leverages AWS SDK's automatic endpoint routing based on ARN format
• Added comprehensive unit tests for ARN detection logic

References

• AWS S3 Express One Zone API Documentation
• S3 Express One Zone Regional endpoints documentation

Testing

Usually I would test in my personal AWS account, but directory buckets are awkward resources. Happy to test in work environment if additional testing output is required.

% go test -v ./internal/service/s3control -run TestIsDirectoryBucketARN

=== RUN   TestIsDirectoryBucketARN
=== RUN   TestIsDirectoryBucketARN/Standard_S3_bucket_ARN
=== RUN   TestIsDirectoryBucketARN/S3_Control_Access_Point_ARN
=== RUN   TestIsDirectoryBucketARN/Directory_Bucket_ARN_(S3_Express)
=== RUN   TestIsDirectoryBucketARN/Directory_Bucket_Access_Point_ARN
=== RUN   TestIsDirectoryBucketARN/Empty_ARN
=== RUN   TestIsDirectoryBucketARN/Invalid_ARN_format
--- PASS: TestIsDirectoryBucketARN (0.00s)
    --- PASS: TestIsDirectoryBucketARN/Standard_S3_bucket_ARN (0.00s)
    --- PASS: TestIsDirectoryBucketARN/S3_Control_Access_Point_ARN (0.00s)
    --- PASS: TestIsDirectoryBucketARN/Directory_Bucket_ARN_(S3_Express) (0.00s)
    --- PASS: TestIsDirectoryBucketARN/Directory_Bucket_Access_Point_ARN (0.00s)
    --- PASS: TestIsDirectoryBucketARN/Empty_ARN (0.00s)
    --- PASS: TestIsDirectoryBucketARN/Invalid_ARN_format (0.00s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/s3control  6.573s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.

[christophersherman]

I might as well add support for all the other s3 control operations

[christophersherman]

Friendly bump