fix(import): validate ARN format, region, and account before extracting resource ID

Previously, --arn was parsed with a blind split('/').pop() with no
validation. Now parseAndValidateArn checks the ARN matches the expected
format, resource type, and that region/account match the deployment target.

Author: jesseturner21

src/cli/commands/import/__tests__/import-runtime-handler.test.ts

@@ -20,12 +20,15 @@ const mockUpdateDeployedState = vi.fn();
 const mockCopyAgentSource = vi.fn();
 const mockToStackName = vi.fn();
 
+const mockParseAndValidateArn = vi.fn();
+
 vi.mock('../import-utils', () => ({
   resolveProjectContext: (...args: unknown[]) => mockResolveProjectContext(...args),
   resolveImportTarget: (...args: unknown[]) => mockResolveImportTarget(...args),
   updateDeployedState: (...args: unknown[]) => mockUpdateDeployedState(...args),
   copyAgentSource: (...args: unknown[]) => mockCopyAgentSource(...args),
   toStackName: (...args: unknown[]) => mockToStackName(...args),
+  parseAndValidateArn: (...args: unknown[]) => mockParseAndValidateArn(...args),
 }));
 
 const mockGetAgentRuntimeDetail = vi.fn();
@@ -118,6 +121,13 @@ function setupDefaultMocks() {
     account: '123456789012',
   });
 
+  mockParseAndValidateArn.mockReturnValue({
+    region: 'us-east-1',
+    account: '123',
+    resourceType: 'runtime',
+    resourceId: 'rt-123',
+  });
+
   mockConfigIO.readProjectSpec.mockResolvedValue({ ...defaultProjectSpec, runtimes: [] });
 }
 

src/cli/commands/import/import-memory.ts

@@ -5,7 +5,13 @@ import { LocalCdkProject } from '../../cdk/local-cdk-project';
 import { silentIoHost } from '../../cdk/toolkit-lib';
 import { ExecLogger } from '../../logging';
 import { bootstrapEnvironment, buildCdkProject, checkBootstrapNeeded, synthesizeCdk } from '../../operations/deploy';
-import { resolveImportTarget, resolveProjectContext, toStackName, updateDeployedState } from './import-utils';
+import {
+  parseAndValidateArn,
+  resolveImportTarget,
+  resolveProjectContext,
+  toStackName,
+  updateDeployedState,
+} from './import-utils';
 import { executePhase1, getDeployedTemplate } from './phase1-update';
 import { executePhase2, publishCdkAssets } from './phase2-import';
 import type { CfnTemplate } from './template-utils';
@@ -91,7 +97,8 @@ export async function handleImportMemory(options: ImportResourceOptions): Promis
     let memoryId: string;
 
     if (options.arn) {
-      memoryId = options.arn.split('/').pop()!;
+      const parsed = parseAndValidateArn(options.arn, 'memory', target);
+      memoryId = parsed.resourceId;
     } else {
       // List memories and show to user
       onProgress('Listing memories in your account...');

src/cli/commands/import/import-runtime.ts

@@ -7,6 +7,7 @@ import { ExecLogger } from '../../logging';
 import { bootstrapEnvironment, buildCdkProject, checkBootstrapNeeded, synthesizeCdk } from '../../operations/deploy';
 import {
   copyAgentSource,
+  parseAndValidateArn,
   resolveImportTarget,
   resolveProjectContext,
   toStackName,
@@ -105,7 +106,8 @@ export async function handleImportRuntime(options: ImportResourceOptions): Promi
     let runtimeId: string;
 
     if (options.arn) {
-      runtimeId = options.arn.split('/').pop()!;
+      const parsed = parseAndValidateArn(options.arn, 'runtime', target);
+      runtimeId = parsed.resourceId;
     } else {
       // List runtimes and let user pick
       onProgress('Listing runtimes in your account...');

src/cli/commands/import/import-utils.ts

@@ -99,6 +99,56 @@ export async function resolveImportTarget(options: ResolveTargetOptions): Promis
   return target;
 }
 
+// ============================================================================
+// ARN Validation
+// ============================================================================
+
+export interface ParsedArn {
+  region: string;
+  account: string;
+  resourceType: string;
+  resourceId: string;
+}
+
+const ARN_PATTERN = /^arn:aws:bedrock-agentcore:([^:]+):([^:]+):(runtime|memory)\/(.+)$/;
+
+/**
+ * Parse and validate a BedrockAgentCore ARN.
+ * Validates format, region, and account against the deployment target.
+ */
+export function parseAndValidateArn(
+  arn: string,
+  expectedResourceType: 'runtime' | 'memory',
+  target: { region: string; account: string }
+): ParsedArn {
+  const match = ARN_PATTERN.exec(arn);
+  if (!match) {
+    throw new Error(
+      `Invalid ARN format: "${arn}". Expected format: arn:aws:bedrock-agentcore:<region>:<account>:${expectedResourceType}/<id>`
+    );
+  }
+
+  const [, region, account, resourceType, resourceId] = match;
+
+  if (resourceType !== expectedResourceType) {
+    throw new Error(`ARN resource type "${resourceType}" does not match expected type "${expectedResourceType}".`);
+  }
+
+  if (region !== target.region) {
+    throw new Error(
+      `ARN region "${region}" does not match target region "${target.region}". Use --target to select a different deployment target.`
+    );
+  }
+
+  if (account !== target.account) {
+    throw new Error(
+      `ARN account "${account}" does not match target account "${target.account}". Ensure the ARN belongs to the correct account.`
+    );
+  }
+
+  return { region, account, resourceType, resourceId: resourceId! };
+}
+
 // ============================================================================
 // Stack Name
 // ============================================================================