Partitions: The Hard Boundaries

We often say AWS is global, but it is actually split into three completely isolated parallel universes called Partitions. A partition is the hardest isolation boundary in AWS — harder than a Region. No identity, no data, and no API call crosses a partition boundary.

1. The Standard Partition (aws)

This contains almost all commercial regions: us-east-1, eu-west-1, ap-southeast-1, and dozens more.

• IAM scope: IAM is a global service within this partition. An IAM user or role can be used to access resources in any standard region. However, it cannot be used to access resources in aws-cn or aws-us-gov.
• ARN format: Resources in this partition have ARNs starting with arn:aws:...

2. The China Partition (aws-cn)

Due to Chinese internet regulations and licensing requirements, AWS China is operated by local partners (Sinnet in Beijing, NWCD in Ningxia) and is physically and logically completely separate from the rest of AWS.

• Isolation: You cannot use an IAM user from the standard aws partition to access aws-cn. You need a completely separate AWS account, registered through the Chinese partner.
• Regions: cn-north-1 (Beijing), cn-northwest-1 (Ningxia).
• ARN format: arn:aws-cn:...
• Service gaps: Not all AWS services are available in China. The service catalog is smaller and may lag behind the standard partition.

3. The GovCloud Partition (aws-us-gov)

Built specifically for US Government agencies and their contractors who must meet strict compliance frameworks including ITAR (International Traffic in Arms Regulations), FedRAMP High, and DoD IL2/IL4/IL5.

• Isolation: Completely isolated from standard AWS. The console login URL is different, accounts must be sponsored by an existing GovCloud customer, and only US persons (citizens and permanent residents) are permitted to operate the infrastructure.
• Regions: us-gov-west-1 (Oregon), us-gov-east-1 (Virginia).
• ARN format: arn:aws-us-gov:...

The Infrastructure-as-Code Implication

This is where partitions become a practical engineering concern. If you hardcode ARNs in your Terraform or CloudFormation templates like this:

# BAD: Hardcoded partition — breaks in GovCloud and China
resource "aws_iam_policy" "example" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:GetObject"
      Resource = "arn:aws:s3:::my-bucket/*"
    }]
  })
}

This template will fail in GovCloud because the ARN prefix arn:aws: is invalid there. The correct approach uses dynamic partition resolution:

# GOOD: Partition resolved dynamically at deploy time
data "aws_partition" "current" {}

resource "aws_iam_policy" "example" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:GetObject"
      Resource = "arn:${data.aws_partition.current.partition}:s3:::my-bucket/*"
    }]
  })
}

The data.aws_partition.current.partition value will automatically resolve to aws, aws-cn, or aws-us-gov depending on where the template is deployed.