fix: copilot issues

Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com>

Author: gusfcarvalho

main.go

@@ -890,6 +890,9 @@ func parseNetworkDiagnosticEndpoint(value string) (networkDiagnosticEndpoint, er
 	if err != nil {
 		return networkDiagnosticEndpoint{}, fmt.Errorf("failed to parse network diagnostic endpoint %q: %w", original, err)
 	}
+	if parsed.Scheme != "" && !strings.EqualFold(parsed.Scheme, "https") {
+		return networkDiagnosticEndpoint{}, fmt.Errorf("network diagnostic endpoint %q has unsupported scheme %q: only https endpoints are supported", original, parsed.Scheme)
+	}
 	host := strings.TrimSpace(parsed.Hostname())
 	if host == "" {
 		return networkDiagnosticEndpoint{}, fmt.Errorf("network diagnostic endpoint %q does not include a host", original)
@@ -2826,11 +2829,38 @@ func awsResourceExplorerResourceARN(payload *StandardizedResourcePayload) (strin
 		if !ok {
 			return "", "aws.s3 resource id is not a valid S3 bucket name"
 		}
-		return "arn:aws:s3:::" + bucketName, ""
+		return "arn:" + awsPartitionForResource(payload.Resource) + ":s3:::" + bucketName, ""
 	}
 	return "", "resource id is not an ARN"
 }
 
+func awsPartitionForResource(resource StandardizedResourceInfo) string {
+	if partition := awsPartitionFromARN(resource.AccountID); partition != "" {
+		return partition
+	}
+	return awsPartitionForRegion(resource.Region)
+}
+
+func awsPartitionFromARN(arnValue string) string {
+	parts := strings.SplitN(strings.TrimSpace(arnValue), ":", 3)
+	if len(parts) >= 2 && parts[0] == "arn" && strings.TrimSpace(parts[1]) != "" {
+		return strings.TrimSpace(parts[1])
+	}
+	return ""
+}
+
+func awsPartitionForRegion(region string) string {
+	region = strings.TrimSpace(strings.ToLower(region))
+	switch {
+	case strings.HasPrefix(region, "cn-"):
+		return "aws-cn"
+	case strings.HasPrefix(region, "us-gov-"):
+		return "aws-us-gov"
+	default:
+		return "aws"
+	}
+}
+
 func normalizeS3BucketName(resourceID string) (string, bool) {
 	bucketName := strings.TrimSpace(resourceID)
 	bucketName = strings.TrimPrefix(bucketName, "s3://")

main_test.go

@@ -1133,6 +1133,16 @@ func TestDiagnosticHelpers(t *testing.T) {
 		}
 	})
 
+	t.Run("rejects non https configured endpoint schemes", func(t *testing.T) {
+		_, _, err := awsDiagnosticEndpointsForCheck("aws.backup-vault", nil, []string{"http://vpce-123.backup.eu-west-1.vpce.amazonaws.com:80"})
+		if err == nil {
+			t.Fatalf("expected unsupported endpoint scheme error")
+		}
+		if !strings.Contains(err.Error(), "only https endpoints are supported") {
+			t.Fatalf("expected unsupported scheme detail, got %v", err)
+		}
+	})
+
 	t.Run("tls probe returns immediately when context is canceled", func(t *testing.T) {
 		ctx, cancel := context.WithCancel(context.Background())
 		cancel()
@@ -1752,6 +1762,46 @@ func TestAWSResourceExplorerURL(t *testing.T) {
 			want:     "https://console.aws.amazon.com/resource-explorer/home?region=us-east-1#/search?query=id%3Aarn%3Aaws%3As3%3A%3A%3Aexample-bucket",
 			wantLink: true,
 		},
+		{
+			name: "s3 bucket in china region uses aws cn partition",
+			payload: &StandardizedResourcePayload{
+				Resource: StandardizedResourceInfo{
+					ID:       "example-bucket",
+					Type:     "aws.s3",
+					Provider: "aws",
+					Region:   "cn-north-1",
+				},
+			},
+			want:     "https://console.aws.amazon.com/resource-explorer/home?region=cn-north-1#/search?query=id%3Aarn%3Aaws-cn%3As3%3A%3A%3Aexample-bucket",
+			wantLink: true,
+		},
+		{
+			name: "s3 bucket in gov region uses aws us gov partition",
+			payload: &StandardizedResourcePayload{
+				Resource: StandardizedResourceInfo{
+					ID:       "example-bucket",
+					Type:     "aws.s3",
+					Provider: "aws",
+					Region:   "us-gov-west-1",
+				},
+			},
+			want:     "https://console.aws.amazon.com/resource-explorer/home?region=us-gov-west-1#/search?query=id%3Aarn%3Aaws-us-gov%3As3%3A%3A%3Aexample-bucket",
+			wantLink: true,
+		},
+		{
+			name: "s3 bucket uses account id arn partition hint",
+			payload: &StandardizedResourcePayload{
+				Resource: StandardizedResourceInfo{
+					ID:        "example-bucket",
+					Type:      "aws.s3",
+					Provider:  "aws",
+					AccountID: "arn:aws-us-gov:iam::123456789012:root",
+					Region:    "us-east-1",
+				},
+			},
+			want:     "https://console.aws.amazon.com/resource-explorer/home?region=us-east-1#/search?query=id%3Aarn%3Aaws-us-gov%3As3%3A%3A%3Aexample-bucket",
+			wantLink: true,
+		},
 		{
 			name: "non arn non s3 resource id has no resource explorer link",
 			payload: &StandardizedResourcePayload{