add govcloud support

src/cli/aws/cloudwatch.ts

@@ -1,4 +1,5 @@
 import { getCredentialProvider } from './account';
+import { arnPrefix } from './partition';
 import { CloudWatchLogsClient, FilterLogEventsCommand, StartLiveTailCommand } from '@aws-sdk/client-cloudwatch-logs';
 
 export interface LogEvent {
@@ -31,7 +32,7 @@ export async function* streamLogs(options: StreamLogsOptions): AsyncGenerator<Lo
   const { logGroupName, region, accountId, filterPattern, abortSignal } = options;
 
   // StartLiveTail requires ARN format for logGroupIdentifiers
-  const logGroupArn = `arn:aws:logs:${region}:${accountId}:log-group:${logGroupName}`;
+  const logGroupArn = `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:${logGroupName}`;
 
   while (!abortSignal?.aborted) {
     const client = new CloudWatchLogsClient({

src/cli/aws/index.ts

@@ -1,5 +1,6 @@
 export { detectAwsContext, type AwsContext } from './aws-context';
 export { detectAccount, getCredentialProvider } from './account';
+export { getPartition, arnPrefix } from './partition';
 export { detectRegion, type RegionDetectionResult } from './region';
 export {
   invokeBedrockSync,

src/cli/aws/partition.ts

@@ -0,0 +1,15 @@
+/**
+ * Derive the AWS partition from a region string.
+ */
+export function getPartition(region: string): string {
+  if (region.startsWith('us-gov-')) return 'aws-us-gov';
+  if (region.startsWith('cn-')) return 'aws-cn';
+  return 'aws';
+}
+
+/**
+ * Return the ARN prefix (e.g. "arn:aws" or "arn:aws-us-gov") for a given region.
+ */
+export function arnPrefix(region: string): string {
+  return `arn:${getPartition(region)}`;
+}

src/cli/aws/transaction-search.ts

@@ -1,5 +1,6 @@
 import { getErrorMessage, isAccessDeniedError } from '../errors';
 import { getCredentialProvider } from './account';
+import { arnPrefix } from './partition';
 import { ApplicationSignalsClient, StartDiscoveryCommand } from '@aws-sdk/client-application-signals';
 import {
   CloudWatchLogsClient,
@@ -64,11 +65,11 @@ export async function enableTransactionSearch(
             Principal: { Service: 'xray.amazonaws.com' },
             Action: 'logs:PutLogEvents',
             Resource: [
-              `arn:aws:logs:${region}:${accountId}:log-group:aws/spans:*`,
-              `arn:aws:logs:${region}:${accountId}:log-group:/aws/application-signals/data:*`,
+              `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:aws/spans:*`,
+              `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:/aws/application-signals/data:*`,
             ],
             Condition: {
-              ArnLike: { 'aws:SourceArn': `arn:aws:xray:${region}:${accountId}:*` },
+              ArnLike: { 'aws:SourceArn': `${arnPrefix(region)}:xray:${region}:${accountId}:*` },
               StringEquals: { 'aws:SourceAccount': accountId },
             },
           },

src/cli/commands/import/actions.ts

@@ -8,6 +8,7 @@ import type {
   Memory,
 } from '../../../schema';
 import { validateAwsCredentials } from '../../aws/account';
+import { arnPrefix } from '../../aws/partition';
 import { LocalCdkProject } from '../../cdk/local-cdk-project';
 import { silentIoHost } from '../../cdk/toolkit-lib';
 import { ExecLogger } from '../../logging';
@@ -721,7 +722,7 @@ export async function handleImport(options: ImportOptions): Promise<ImportResult
             runtimeId: agent.physicalAgentId,
             runtimeArn:
               agent.physicalAgentArn ??
-              `arn:aws:bedrock-agentcore:${target.region}:${target.account}:runtime/${agent.physicalAgentId}`,
+              `${arnPrefix(target.region)}:bedrock-agentcore:${target.region}:${target.account}:runtime/${agent.physicalAgentId}`,
             roleArn: 'imported', // Placeholder — updated after agentcore deploy
           };
         }
@@ -736,7 +737,7 @@ export async function handleImport(options: ImportOptions): Promise<ImportResult
             memoryId: memory.physicalMemoryId,
             memoryArn:
               memory.physicalMemoryArn ??
-              `arn:aws:bedrock-agentcore:${target.region}:${target.account}:memory/${memory.physicalMemoryId}`,
+              `${arnPrefix(target.region)}:bedrock-agentcore:${target.region}:${target.account}:memory/${memory.physicalMemoryId}`,
           };
         }
       }

src/cli/operations/agent/import/constants.ts

@@ -12,6 +12,7 @@ export const BEDROCK_REGIONS = [
   { id: 'ap-south-1', title: 'Asia Pacific (Mumbai)' },
   { id: 'ca-central-1', title: 'Canada (Central)' },
   { id: 'sa-east-1', title: 'South America (Sao Paulo)' },
+  { id: 'us-gov-west-1', title: 'GovCloud (US West)' },
 ] as const;
 
 export const IMPORT_FRAMEWORK_OPTIONS = [

src/schema/llm-compacted/aws-targets.ts

@@ -34,4 +34,5 @@ type AgentCoreRegion =
   | 'eu-west-1'
   | 'us-east-1'
   | 'us-east-2'
-  | 'us-west-2';
+  | 'us-west-2'
+  | 'us-gov-west-1';

src/schema/schemas/__tests__/aws-targets.test.ts

@@ -18,6 +18,7 @@ describe('AgentCoreRegionSchema', () => {
     'us-east-1',
     'us-east-2',
     'us-west-2',
+    'us-gov-west-1',
   ];
 
   it.each(validRegions)('accepts valid region "%s"', region => {

src/schema/schemas/aws-targets.ts

@@ -15,6 +15,7 @@ export const AgentCoreRegionSchema = z.enum([
   'us-east-1',
   'us-east-2',
   'us-west-2',
+  'us-gov-west-1',
 ]);
 export type AgentCoreRegion = z.infer<typeof AgentCoreRegionSchema>;