Summary

AwsUtil.GetRoleArn hardcodes the commercial AWS partition (arn:aws:iam::...) when constructing the cross-account AssumeRole ARN. In any non-commercial partition this produces ARNs that the running partition's IAM cannot resolve, breaking every multi-account operation — including the post-CreateAccount initial assume into a freshly provisioned member account.

The partition is already determined dynamically during Initialize() via GetPartitionFromCurrentSession() (uses STS GetCallerIdentity) and cached on AwsUtil.partition. This change uses that cached value, falling back to 'aws' so the commercial path is byte-for-byte unchanged.

The GovCloud-mode GetPartitionRoleArn is intentionally left alone — it represents a cross-partition target ARN and its semantics differ (commercial → GovCloud mirroring).

How I hit this

Bootstrapping a multi-account organization in AWS European Sovereign Cloud (eusc-de-east-1, partition aws-eusc):

1. First update-organization against the EUSC master account: ✅ works.
2. CreateAccount for a sandbox member: ✅ AWS provisions the account, OFN sees the new account ID.
3. OFN immediately tries to assume OrganizationAccountAccessRole in the new member to set tags / move to OU.
4. ❌ AccessDenied: ... is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::<member-id>:role/OrganizationAccountAccessRole — note the aws: partition in a partition that doesn't know it.

With this patch, the ARN becomes arn:aws-eusc:iam::... and the assume succeeds. Validated end-to-end: org-create, account-create, IAM stack in member, SSO assignment in master — all green.

Compatibility

• Commercial AWS: AwsUtil.partition === 'aws' (set during Initialize), behavior identical.
• GovCloud: same — partition cache is 'aws-us-gov' for runs in that partition.
• Pre-Initialize call (defensive): falls back to 'aws', same as before.

Out of scope (audit notes for reviewers)

A wider grep for partition-relevant hardcodes turned up a handful of others, all in code paths my EUSC use case does not exercise. Listed for transparency, intentionally not in this PR to keep the diff focused:

• src/parser/validator.ts:176 — knownRegions whitelist lacks eusc-de-east-1 (produces a non-fatal WARN: region not recognized).
• src/aws-provider/aws-events.ts:52 — us-east-1 hardcoded for the post-run OrganizationChanged EventBridge notification (non-fatal unable to put event after successful runs in EUSC).
• src/util/aws-util.ts:752 — large-template S3 URL uses s3.<region>.amazonaws.com literal (only triggers for templates over the inline-body limit).
• src/plugin/impl/rp-build-task-plugin.ts:187 — community resource provider catalog URL uses s3.amazonaws.com literal (only triggers when registering custom resource types; EUSC currently has no Public Extensions registry, so this needs a different solution anyway).
• src/aws-provider/aws-organization-reader.ts:74 — partition mirror detection only matches aws-us-gov, not other non-commercial partitions.

Happy to follow up with separate PRs for any of these if useful.

Relation to #613

#613 (feat/eusc) addresses a different scenario: managing a commercial Org and an EUSC Org in mirror mode (analogous to the existing GovCloud mirror). My use case is a standalone EUSC Org with no commercial counterpart, where the only thing missing is partition-correct ARN construction. The two changes are orthogonal and could land independently.