arnmatch 2026.1.2__tar.gz → 2026.1.3__tar.gz

{arnmatch-2026.1.2 → arnmatch-2026.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arnmatch
-Version: 2026.1.2
+Version: 2026.1.3
 Summary: Parse AWS ARNs into structured data (2000+ resource types)
 Author-email: Andrey Gubarev <andrey@andreygubarev.com>
 Requires-Python: >=3.10

{arnmatch-2026.1.2 → arnmatch-2026.1.3}/codegen/codegen.py

@@ -9,6 +9,7 @@ from pathlib import Path
 
 from scraper import AWSScraper
 from index_sdk import SDKServiceIndexer
+from index_sdk_resources import SDKResourceIndexer
 
 log = logging.getLogger(__name__)
 
@@ -264,8 +265,22 @@ class CodeGenerator:
             # Write SDK services mapping
             f.write("# Auto-generated mapping: ARN service -> AWS SDK client names\n")
             f.write("AWS_SDK_SERVICES = {\n")
-            for arn_svc, clients in sorted(sdk_services_mapping.items()):
-                f.write(f"    {arn_svc!r}: {clients!r},\n")
+            for arn_service, clients in sorted(sdk_services_mapping.items()):
+                f.write(f"    {arn_service!r}: {clients!r},\n")
+            f.write("}\n\n")
+
+            # Write SDK default service mapping
+            f.write("# Default SDK for multi-SDK services\n")
+            f.write("AWS_SDK_SERVICES_DEFAULT = {\n")
+            for arn_service, sdk in sorted(SDKResourceIndexer.DEFAULT_SERVICE.items()):
+                f.write(f"    {arn_service!r}: {sdk!r},\n")
+            f.write("}\n\n")
+
+            # Write SDK service overrides (resource-level)
+            f.write("# Resource-level SDK overrides: resource_type -> sdk_client\n")
+            f.write("AWS_SDK_SERVICES_OVERRIDE = {\n")
+            for arn_service, overrides in sorted(SDKResourceIndexer.OVERRIDE_SERVICE.items()):
+                f.write(f"    {arn_service!r}: {overrides!r},\n")
             f.write("}\n")
 
         log.info(f"Wrote {len(resources)} patterns for {len(by_service)} services to {output_path}")
@@ -318,6 +333,10 @@ def main():
     sdk_indexer = SDKServiceIndexer()
     sdk_mapping = sdk_indexer.process(arn_services)
 
+    # Validate multi-SDK services have DEFAULT_SERVICE entries
+    sdk_resource_indexer = SDKResourceIndexer()
+    sdk_resource_indexer.process(sdk_mapping)
+
     # Generate
     BUILD_DIR.mkdir(exist_ok=True)
     generator = CodeGenerator()

arnmatch-2026.1.3/codegen/index_sdk_resources.py

@@ -0,0 +1,199 @@
+"""Maps ARN resource types to specific SDK clients for multi-SDK services.
+
+Why aws_sdk_services (plural) exists alongside aws_sdk_service (singular):
+
+Some services share identical ARN formats but are fundamentally different engines.
+For example, RDS, Neptune, and DocumentDB all use the same ARN structure:
+  arn:aws:rds:region:account:db:instance-name
+
+The ARN alone cannot distinguish between these engines - you need external context
+(tags, API calls, or prior knowledge) to determine the correct SDK. In these cases,
+aws_sdk_service returns the default (rds), while aws_sdk_services returns all
+possible SDKs [rds, neptune, docdb] for the caller to disambiguate.
+"""
+
+
+class SDKResourceIndexer:
+    """SDK defaults for services with multiple SDK clients.
+
+    DEFAULT_SERVICE: Service-level default where all resources use a single SDK.
+    Format: "arn_service" -> "sdk_client"
+
+    OVERRIDE_SERVICE: Resource-level overrides where different resources use different SDKs.
+    Format: "arn_service" -> {"resource_type": "sdk_client", ...}
+    """
+
+    # Service-level default - the SDK responsible for most resources
+    # (other auto-detected SDKs are typically runtime/data/query clients)
+    DEFAULT_SERVICE = {
+        "apigateway": "apigateway",  # v1 REST API; v2 is HTTP/WebSocket
+        "appconfig": "appconfig",  # appconfigdata is runtime-only
+        "aws-marketplace": "marketplace-catalog",  # entity management
+        "bedrock": "bedrock",  # model management
+        "bedrock-agentcore": "bedrock-agentcore-control",  # control plane
+        "cassandra": "keyspaces",  # keyspacesstreams is CDC
+        "chime": "chime",  # others are specialized SDKs
+        "cloudhsm": "cloudhsmv2",  # v1 deprecated
+        "cloudsearch": "cloudsearch",  # domain is query-only
+        "connect": "connect",  # contact-lens is analytics
+        "connect-campaigns": "connectcampaignsv2",  # v1 deprecated
+        "dynamodb": "dynamodb",  # streams is CDC
+        "elasticloadbalancing": "elbv2",  # ALB/NLB/GLB; elb is classic
+        "es": "opensearch",  # Elasticsearch rebranded
+        "execute-api": "apigatewaymanagementapi",  # WebSocket management
+        "forecast": "forecast",  # forecastquery is runtime
+        "greengrass": "greengrassv2",  # v1 deprecated
+        "ivs": "ivs",  # ivs-realtime is stages
+        "kinesisanalytics": "kinesisanalyticsv2",  # v1 deprecated
+        "kinesisvideo": "kinesisvideo",  # others are media streaming
+        "lex": "lexv2-models",  # v1 deprecated
+        "mediastore": "mediastore",  # data is object operations
+        "mgh": "mgh",  # config is home region only
+        "partnercentral": "partnercentral-selling",  # primary module
+        "payment-cryptography": "payment-cryptography",  # data is crypto ops
+        "personalize": "personalize",  # events/runtime are runtime
+        "rds": "rds",  # docdb/neptune are different engines
+        "route53-recovery-control": "route53-recovery-control-config",  # cluster is data plane
+        "s3": "s3",  # s3control is account-level
+        "sagemaker": "sagemaker",  # others are runtime/edge/metrics
+        "servicecatalog": "servicecatalog",  # appregistry is separate
+        "ses": "sesv2",  # v1 deprecated
+        "sms-voice": "pinpoint-sms-voice-v2",  # v1 deprecated
+        "sso": "sso-admin",  # sso is portal access
+        "timestream": "timestream-write",  # query is queries only
+        "wisdom": "qconnect",  # rebranded to Q Connect
+    }
+
+    # Resource-level overrides - only non-default SDK mappings
+    # Format: "arn_service" -> {"resource_type": "sdk_client", ...}
+    OVERRIDE_SERVICE = {
+        "apigateway": {
+            # v2 (HTTP/WebSocket API) resources
+            "ApiMappings": "apigatewayv2",
+            "ApiMapping": "apigatewayv2",
+            "Apis": "apigatewayv2",
+            "Api": "apigatewayv2",
+            "Cors": "apigatewayv2",
+            "ExportedAPI": "apigatewayv2",
+            "Integrations": "apigatewayv2",
+            "RouteRequestParameter": "apigatewayv2",
+            "RouteResponses": "apigatewayv2",
+            "RouteResponse": "apigatewayv2",
+            "RouteSettings": "apigatewayv2",
+            "Routes": "apigatewayv2",
+            "Route": "apigatewayv2",
+        },
+        "bedrock": {
+            # bedrock-agent resources
+            "agent-alias": "bedrock-agent",
+            "agent": "bedrock-agent",
+            "default-prompt-router": "bedrock-agent",
+            "flow-alias": "bedrock-agent",
+            "flow-execution": "bedrock-agent",
+            "flow": "bedrock-agent",
+            "knowledge-base": "bedrock-agent",
+            "prompt-router": "bedrock-agent",
+            "prompt-version": "bedrock-agent",
+            "prompt": "bedrock-agent",
+            # bedrock-agent-runtime
+            "session": "bedrock-agent-runtime",
+            # bedrock-runtime
+            "async-invoke": "bedrock-runtime",
+        },
+        "chime": {
+            "meeting": "chime-sdk-meetings",
+            "app-instance": "chime-sdk-identity",
+            "app-instance-bot": "chime-sdk-identity",
+            "app-instance-user": "chime-sdk-identity",
+            "channel": "chime-sdk-messaging",
+            "channel-flow": "chime-sdk-messaging",
+            "media-insights-pipeline-configuration": "chime-sdk-media-pipelines",
+            "media-pipeline": "chime-sdk-media-pipelines",
+            "media-pipeline-kinesis-video-stream-pool": "chime-sdk-media-pipelines",
+            "sip-media-application": "chime-sdk-voice",
+            "voice-connector-group": "chime-sdk-voice",
+            "voice-connector": "chime-sdk-voice",
+            "voice-profile": "chime-sdk-voice",
+            "voice-profile-domain": "chime-sdk-voice",
+        },
+        "dynamodb": {
+            "stream": "dynamodbstreams",
+        },
+        "elasticloadbalancing": {
+            "loadbalancer": "elb",  # classic
+        },
+        "greengrass": {
+            # v1 resources (v2 is default)
+            "bulkDeployment": "greengrass",
+            "certificateAuthority": "greengrass",
+            "connectivityInfo": "greengrass",
+            "connectorDefinitionVersion": "greengrass",
+            "connectorDefinition": "greengrass",
+            "coreDefinitionVersion": "greengrass",
+            "coreDefinition": "greengrass",
+            "deviceDefinitionVersion": "greengrass",
+            "deviceDefinition": "greengrass",
+            "functionDefinitionVersion": "greengrass",
+            "functionDefinition": "greengrass",
+            "groupVersion": "greengrass",
+            "group": "greengrass",
+            "loggerDefinitionVersion": "greengrass",
+            "loggerDefinition": "greengrass",
+            "resourceDefinitionVersion": "greengrass",
+            "resourceDefinition": "greengrass",
+            "subscriptionDefinitionVersion": "greengrass",
+            "subscriptionDefinition": "greengrass",
+            "thingRuntimeConfig": "greengrass",
+        },
+        "ivs": {
+            # ivs-realtime resources
+            "Composition": "ivs-realtime",
+            "Encoder-Configuration": "ivs-realtime",
+            "Ingest-Configuration": "ivs-realtime",
+            "Public-Key": "ivs-realtime",
+            "Stage": "ivs-realtime",
+            "Storage-Configuration": "ivs-realtime",
+        },
+        "lex": {
+            # v1 resources
+            "channel": "lex-models",
+            "intent version": "lex-models",
+            "slottype version": "lex-models",
+        },
+        "mediastore": {
+            "folder": "mediastore-data",
+            "object": "mediastore-data",
+        },
+        "partnercentral": {
+            "BenefitAllocation": "partnercentral-benefits",
+            "BenefitApplication": "partnercentral-benefits",
+            "Benefit": "partnercentral-benefits",
+            "ChannelHandshake": "partnercentral-channel",
+            "ProgramManagementAccount": "partnercentral-account",
+        },
+        "s3": {
+            "accessgrant": "s3control",
+            "accessgrantslocation": "s3control",
+            "accessgrantsinstance": "s3control",
+            "accesspoint": "s3control",
+            "accesspointobject": "s3control",
+            "job": "s3control",
+            "multiregionaccesspoint": "s3control",
+            "multiregionaccesspointrequestarn": "s3control",
+            "storagelensconfiguration": "s3control",
+            "storagelensgroup": "s3control",
+        },
+        "servicecatalog": {
+            "Application": "servicecatalog-appregistry",
+            "AttributeGroup": "servicecatalog-appregistry",
+        },
+    }
+
+    def process(self, sdk_mapping):
+        """Validate all multi-SDK services have a DEFAULT_SERVICE entry."""
+        missing = {}
+        for arn_service, sdks in sdk_mapping.items():
+            if len(sdks) > 1 and arn_service not in self.DEFAULT_SERVICE:
+                missing[arn_service] = sdks
+        if missing:
+            raise RuntimeError(f"Missing DEFAULT_SERVICE for multi-SDK services: {missing}")

{arnmatch-2026.1.2 → arnmatch-2026.1.3}/src/arnmatch/__init__.py

@@ -1,12 +1,17 @@
 """ARN pattern matching using regex patterns."""
 
-__version__ = "2026.01.2"
+__version__ = "2026.01.3"
 
 import sys
 from dataclasses import dataclass
 from functools import cached_property
 
-from .arn_patterns import ARN_PATTERNS, AWS_SDK_SERVICES
+from .arn_patterns import (
+    ARN_PATTERNS,
+    AWS_SDK_SERVICES,
+    AWS_SDK_SERVICES_DEFAULT,
+    AWS_SDK_SERVICES_OVERRIDE,
+)
 
 # Standard groups that are not resource-specific
 STANDARD_GROUPS = {"Partition", "Region", "Account"}
@@ -78,7 +83,7 @@ class ARN:
         return self.resource_id
 
     @cached_property
-    def aws_sdk_services(self):
+    def aws_sdk_services(self) -> list[str]:
         """Get AWS SDK (boto3) client names for this resource's service.
 
         Returns list of client names that can interact with this resource type.
@@ -88,6 +93,26 @@ class ARN:
         """
         return AWS_SDK_SERVICES.get(self.aws_service, [])
 
+    @cached_property
+    def aws_sdk_service(self) -> str | None:
+        """Get the AWS SDK (boto3) client name for this resource.
+
+        Returns single client name. Checks resource-level overrides first,
+        then falls back to service default. Returns None if no SDK exists.
+        """
+        # Check resource-level override
+        overrides = AWS_SDK_SERVICES_OVERRIDE.get(self.aws_service)
+        if overrides and self.resource_type in overrides:
+            return overrides[self.resource_type]
+
+        # Fall back to service-level
+        sdks = self.aws_sdk_services
+        if len(sdks) == 1:
+            return sdks[0]
+        if len(sdks) > 1:
+            return AWS_SDK_SERVICES_DEFAULT.get(self.aws_service)
+        return None
+
 
 def arnmatch(arn: str) -> ARN:
     """Match ARN against patterns.
@@ -132,6 +157,7 @@ def main() -> None:
     try:
         result = arnmatch(arn)
         print(f"aws_service: {result.aws_service}")
+        print(f"aws_sdk_service: {result.aws_sdk_service}")
         print(f"aws_sdk_services: {','.join(result.aws_sdk_services)}")
         print(f"aws_region: {result.aws_region}")
         print(f"aws_account: {result.aws_account}")

{arnmatch-2026.1.2 → arnmatch-2026.1.3}/src/arnmatch/arn_patterns.py

@@ -3155,3 +3155,59 @@ AWS_SDK_SERVICES = {
     'workspaces-web': ['workspaces-web'],
     'xray': ['xray'],
 }
+
+# Default SDK for multi-SDK services
+AWS_SDK_SERVICES_DEFAULT = {
+    'apigateway': 'apigateway',
+    'appconfig': 'appconfig',
+    'aws-marketplace': 'marketplace-catalog',
+    'bedrock': 'bedrock',
+    'bedrock-agentcore': 'bedrock-agentcore-control',
+    'cassandra': 'keyspaces',
+    'chime': 'chime',
+    'cloudhsm': 'cloudhsmv2',
+    'cloudsearch': 'cloudsearch',
+    'connect': 'connect',
+    'connect-campaigns': 'connectcampaignsv2',
+    'dynamodb': 'dynamodb',
+    'elasticloadbalancing': 'elbv2',
+    'es': 'opensearch',
+    'execute-api': 'apigatewaymanagementapi',
+    'forecast': 'forecast',
+    'greengrass': 'greengrassv2',
+    'ivs': 'ivs',
+    'kinesisanalytics': 'kinesisanalyticsv2',
+    'kinesisvideo': 'kinesisvideo',
+    'lex': 'lexv2-models',
+    'mediastore': 'mediastore',
+    'mgh': 'mgh',
+    'partnercentral': 'partnercentral-selling',
+    'payment-cryptography': 'payment-cryptography',
+    'personalize': 'personalize',
+    'rds': 'rds',
+    'route53-recovery-control': 'route53-recovery-control-config',
+    's3': 's3',
+    'sagemaker': 'sagemaker',
+    'servicecatalog': 'servicecatalog',
+    'ses': 'sesv2',
+    'sms-voice': 'pinpoint-sms-voice-v2',
+    'sso': 'sso-admin',
+    'timestream': 'timestream-write',
+    'wisdom': 'qconnect',
+}
+
+# Resource-level SDK overrides: resource_type -> sdk_client
+AWS_SDK_SERVICES_OVERRIDE = {
+    'apigateway': {'ApiMappings': 'apigatewayv2', 'ApiMapping': 'apigatewayv2', 'Apis': 'apigatewayv2', 'Api': 'apigatewayv2', 'Cors': 'apigatewayv2', 'ExportedAPI': 'apigatewayv2', 'Integrations': 'apigatewayv2', 'RouteRequestParameter': 'apigatewayv2', 'RouteResponses': 'apigatewayv2', 'RouteResponse': 'apigatewayv2', 'RouteSettings': 'apigatewayv2', 'Routes': 'apigatewayv2', 'Route': 'apigatewayv2'},
+    'bedrock': {'agent-alias': 'bedrock-agent', 'agent': 'bedrock-agent', 'default-prompt-router': 'bedrock-agent', 'flow-alias': 'bedrock-agent', 'flow-execution': 'bedrock-agent', 'flow': 'bedrock-agent', 'knowledge-base': 'bedrock-agent', 'prompt-router': 'bedrock-agent', 'prompt-version': 'bedrock-agent', 'prompt': 'bedrock-agent', 'session': 'bedrock-agent-runtime', 'async-invoke': 'bedrock-runtime'},
+    'chime': {'meeting': 'chime-sdk-meetings', 'app-instance': 'chime-sdk-identity', 'app-instance-bot': 'chime-sdk-identity', 'app-instance-user': 'chime-sdk-identity', 'channel': 'chime-sdk-messaging', 'channel-flow': 'chime-sdk-messaging', 'media-insights-pipeline-configuration': 'chime-sdk-media-pipelines', 'media-pipeline': 'chime-sdk-media-pipelines', 'media-pipeline-kinesis-video-stream-pool': 'chime-sdk-media-pipelines', 'sip-media-application': 'chime-sdk-voice', 'voice-connector-group': 'chime-sdk-voice', 'voice-connector': 'chime-sdk-voice', 'voice-profile': 'chime-sdk-voice', 'voice-profile-domain': 'chime-sdk-voice'},
+    'dynamodb': {'stream': 'dynamodbstreams'},
+    'elasticloadbalancing': {'loadbalancer': 'elb'},
+    'greengrass': {'bulkDeployment': 'greengrass', 'certificateAuthority': 'greengrass', 'connectivityInfo': 'greengrass', 'connectorDefinitionVersion': 'greengrass', 'connectorDefinition': 'greengrass', 'coreDefinitionVersion': 'greengrass', 'coreDefinition': 'greengrass', 'deviceDefinitionVersion': 'greengrass', 'deviceDefinition': 'greengrass', 'functionDefinitionVersion': 'greengrass', 'functionDefinition': 'greengrass', 'groupVersion': 'greengrass', 'group': 'greengrass', 'loggerDefinitionVersion': 'greengrass', 'loggerDefinition': 'greengrass', 'resourceDefinitionVersion': 'greengrass', 'resourceDefinition': 'greengrass', 'subscriptionDefinitionVersion': 'greengrass', 'subscriptionDefinition': 'greengrass', 'thingRuntimeConfig': 'greengrass'},
+    'ivs': {'Composition': 'ivs-realtime', 'Encoder-Configuration': 'ivs-realtime', 'Ingest-Configuration': 'ivs-realtime', 'Public-Key': 'ivs-realtime', 'Stage': 'ivs-realtime', 'Storage-Configuration': 'ivs-realtime'},
+    'lex': {'channel': 'lex-models', 'intent version': 'lex-models', 'slottype version': 'lex-models'},
+    'mediastore': {'folder': 'mediastore-data', 'object': 'mediastore-data'},
+    'partnercentral': {'BenefitAllocation': 'partnercentral-benefits', 'BenefitApplication': 'partnercentral-benefits', 'Benefit': 'partnercentral-benefits', 'ChannelHandshake': 'partnercentral-channel', 'ProgramManagementAccount': 'partnercentral-account'},
+    's3': {'accessgrant': 's3control', 'accessgrantslocation': 's3control', 'accessgrantsinstance': 's3control', 'accesspoint': 's3control', 'accesspointobject': 's3control', 'job': 's3control', 'multiregionaccesspoint': 's3control', 'multiregionaccesspointrequestarn': 's3control', 'storagelensconfiguration': 's3control', 'storagelensgroup': 's3control'},
+    'servicecatalog': {'Application': 'servicecatalog-appregistry', 'AttributeGroup': 'servicecatalog-appregistry'},
+}

{arnmatch-2026.1.2 → arnmatch-2026.1.3}/tests/test_arnmatch.py

@@ -10,12 +10,20 @@ def test_acm():
     assert result.resource_type == "certificate"
     assert result.attributes["CertificateId"] == "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
     assert result.aws_sdk_services == ["acm"]
+    assert result.aws_sdk_service == "acm"
 
 
 def test_apigateway():
+    # v1 REST API (default)
     result = arnmatch("arn:aws:apigateway:us-east-1::/restapis/abc123def4")
     assert result.resource_type == "RestApi"
     assert result.attributes["RestApiId"] == "abc123def4"
+    assert result.aws_sdk_service == "apigateway"
+
+    # v2 HTTP API (override)
+    result = arnmatch("arn:aws:apigateway:us-east-1::/apis/abc123def4")
+    assert result.resource_type == "Api"
+    assert result.aws_sdk_service == "apigatewayv2"
 
 
 def test_athena():
@@ -100,9 +108,18 @@ def test_datasync():
 
 
 def test_dynamodb():
+    # table (default)
     result = arnmatch("arn:aws:dynamodb:us-east-1:012345678901:table/table1")
     assert result.resource_type == "table"
     assert result.attributes["TableName"] == "table1"
+    assert result.aws_sdk_service == "dynamodb"
+
+    # stream (override)
+    result = arnmatch(
+        "arn:aws:dynamodb:us-east-1:012345678901:table/table1/stream/2024-01-01T00:00:00.000"
+    )
+    assert result.resource_type == "stream"
+    assert result.aws_sdk_service == "dynamodbstreams"
 
 
 def test_ec2():
@@ -220,30 +237,33 @@ def test_elasticfilesystem():
 
 
 def test_elasticloadbalancing():
-    # Classic LB
+    # Classic LB (override)
     result = arnmatch(
         "arn:aws:elasticloadbalancing:us-east-1:012345678901:loadbalancer/a0123456789abcdef0123456789abcde"
     )
     assert result.resource_type == "loadbalancer"
     assert result.attributes["LoadBalancerName"] == "a0123456789abcdef0123456789abcde"
+    assert result.aws_sdk_service == "elb"
 
-    # ALB
+    # ALB (default)
     result = arnmatch(
         "arn:aws:elasticloadbalancing:us-east-1:012345678901:loadbalancer/app/alb-application-lb-name/0123456789abcdef"
     )
     assert result.resource_type == "loadbalancer/app/"
     assert result.attributes["LoadBalancerName"] == "alb-application-lb-name"
     assert result.attributes["LoadBalancerId"] == "0123456789abcdef"
+    assert result.aws_sdk_service == "elbv2"
 
-    # NLB
+    # NLB (default)
     result = arnmatch(
         "arn:aws:elasticloadbalancing:us-east-1:012345678901:loadbalancer/net/nlb-network-load-balancer/0123456789abcdef"
     )
     assert result.resource_type == "loadbalancer/net/"
     assert result.attributes["LoadBalancerName"] == "nlb-network-load-balancer"
     assert result.attributes["LoadBalancerId"] == "0123456789abcdef"
+    assert result.aws_sdk_service == "elbv2"
 
-    # Target group
+    # Target group (default)
     result = arnmatch(
         "arn:aws:elasticloadbalancing:us-east-1:012345678901:targetgroup/target-grp-1/0123456789abcdef"
     )
@@ -252,6 +272,7 @@ def test_elasticloadbalancing():
     assert result.attributes["TargetGroupId"] == "0123456789abcdef"
     # elasticloadbalancing maps to multiple SDK clients
     assert result.aws_sdk_services == ["elb", "elbv2"]
+    assert result.aws_sdk_service == "elbv2"
 
 
 def test_es():
@@ -364,10 +385,17 @@ def test_route53():
 
 
 def test_s3():
+    # bucket (default)
     result = arnmatch("arn:aws:s3:::example-bucket-01")
     assert result.resource_type == "bucket"
     assert result.attributes["BucketName"] == "example-bucket-01"
     assert result.aws_sdk_services == ["s3", "s3control"]
+    assert result.aws_sdk_service == "s3"
+
+    # accesspoint (override)
+    result = arnmatch("arn:aws:s3:us-east-1:012345678901:accesspoint/my-access-point")
+    assert result.resource_type == "accesspoint"
+    assert result.aws_sdk_service == "s3control"
 
 
 def test_secretsmanager():