Hardcoded AWS region in resource argument

What it checks

Literal AWS region in an ARN string.

Where it applies

Terraform: aws_iam_role, aws_lambda_function, aws_sns_topic, aws_sqs_queue

CloudFormation: AWS::IAM::Role, AWS::Lambda::Function, AWS::SNS::Topic, AWS::SQS::Queue

How to fix it

1. Replace only the literal Region segment of each ARN with `data.aws_region.current.region` or a variable. Keep the trusted service principal and every Condition key unchanged. Saves the next person from `sed -i` across all .tf files for an eu-west-1 rollout.

Frameworks

• AWS Well-Architected OPS.5

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules