fix(connectors): sign saved AWS credentials only for commercial and GovCloud S3

China regions serve S3 under amazonaws.com.cn and the isolated partitions
under their own domains, so a saved credential for them failed with an
opaque DNS error. Refuse them with a clear message instead.

Author: waleedlatif1

apps/docs/content/docs/knowledgebase/connectors.mdx

@@ -46,7 +46,7 @@ API-key and personal-access-token connections use the credential shown in their
 | Azure DevOps | PAT with Project and Team Read, Wiki Read, Work Items Read, and Code Read. |
 | GitLab | PAT with `read_api` and access to the selected project; permission-aware methods have additional requirements. |
 | YouTube | YouTube Data API key from Google Cloud Console. |
-| Amazon S3 | Secret Access Key; enter Access Key ID, region, and bucket as configuration fields. Where enabled, **Authentication → Saved AWS credential** uses a workspace AWS credential instead (access keys, an assumed IAM role, or a keyless role trusted through Sim OIDC); it signs only for Amazon S3 in an AWS region, so it has no Access Key ID or custom endpoint. Either way, the identity needs `s3:ListBucket` on the bucket and `s3:GetObject` on the synced objects. |
+| Amazon S3 | Secret Access Key; enter Access Key ID, region, and bucket as configuration fields. Where enabled, **Authentication → Saved AWS credential** uses a workspace AWS credential instead (access keys, an assumed IAM role, or a keyless role trusted through Sim OIDC); it signs only for Amazon S3 in a commercial or GovCloud AWS region (not China or isolated regions), so it has no Access Key ID or custom endpoint. Either way, the identity needs `s3:ListBucket` on the bucket and `s3:GetObject` on the synced objects. |
 | Sentry | Auth token with `project:read` and `event:read`. |
 | PagerDuty | Create a [REST API key](https://support.pagerduty.com/main/docs/api-access-keys) under **Integrations → Developer Tools → API Access Keys**. |
 | SFTP | Password or unencrypted private key, plus a required SHA-256 host-key fingerprint; enter host, port, username, and root path as configuration fields. |

apps/sim/connectors/s3/meta.ts

@@ -32,7 +32,7 @@ export const s3ConnectorMeta: ConnectorMeta = {
       placeholder: 'e.g. us-east-1 (use auto for Cloudflare R2)',
       required: true,
       description:
-        'AWS region for the bucket. For Cloudflare R2 use "auto"; for MinIO use the region the server is configured with (commonly us-east-1). A saved AWS credential needs an AWS region.',
+        'AWS region for the bucket. For Cloudflare R2 use "auto"; for MinIO use the region the server is configured with (commonly us-east-1). A saved AWS credential needs a commercial or GovCloud AWS region.',
     },
     {
       id: 'bucket',

apps/sim/connectors/s3/s3.test.ts

@@ -97,6 +97,36 @@ describe('s3Connector signing', () => {
     expect(mockSecureFetchWithRetry).not.toHaveBeenCalled()
   })
 
+  it.each(['cn-north-1', 'us-iso-east-1', 'eu-isoe-west-1'])(
+    'refuses %s, whose S3 host is not under amazonaws.com, with a saved AWS credential',
+    async (region) => {
+      recordRequests()
+
+      const validation = await s3Connector.validateConfig(
+        'credential-handle',
+        { region, bucket: 'docs' },
+        { ...awsSessionSyncContext(SESSION) }
+      )
+
+      expect(validation.valid).toBe(false)
+      expect(validation.error).toMatch(/commercial or GovCloud/i)
+      expect(mockSecureFetchWithRetry).not.toHaveBeenCalled()
+    }
+  )
+
+  it('signs a saved AWS credential for a GovCloud bucket', async () => {
+    const requests = recordRequests()
+
+    await s3Connector.listDocuments(
+      '',
+      { region: 'us-gov-west-1', bucket: 'docs-bucket' },
+      undefined,
+      { ...awsSessionSyncContext(SESSION) }
+    )
+
+    expect(requests[0]?.url).toMatch(/^https:\/\/docs-bucket\.s3\.us-gov-west-1\.amazonaws\.com\//)
+  })
+
   it('keeps signing inline keys without a session token', async () => {
     const requests = recordRequests()
 

apps/sim/connectors/s3/s3.ts

@@ -53,8 +53,12 @@ const BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{1,62}$/
 /** Accepted region shape — AWS region codes plus Cloudflare R2's `auto`. */
 const REGION_PATTERN = /^[A-Za-z0-9-]{1,64}$/
 
-/** An AWS region code (`us-east-1`, `us-iso-east-1`): the only regions a saved AWS credential signs for. */
-const AWS_REGION_PATTERN = /^[a-z]{2,}(-[a-z]+)+-\d+$/
+/**
+ * A commercial or GovCloud AWS region code (`us-east-1`, `us-gov-west-1`): the only regions a
+ * saved AWS credential signs for, because their S3 hosts are all `s3.<region>.amazonaws.com`.
+ * China (`cn-*`, under `amazonaws.com.cn`) and the isolated partitions use other domains.
+ */
+const AWS_REGION_PATTERN = /^(?!cn-)[a-z]{2}(-gov)?-[a-z]+-\d+$/
 
 /**
  * Default set of file extensions considered safely text-extractable. Objects
@@ -253,7 +257,9 @@ function resolveContext(
       )
     }
     if (!AWS_REGION_PATTERN.test(region)) {
-      throw new Error('A saved AWS credential needs an AWS region, e.g. us-east-1')
+      throw new Error(
+        'A saved AWS credential needs a commercial or GovCloud AWS region, e.g. us-east-1'
+      )
     }
     return { ...savedSession, region, bucket }
   }