fix: scope Step Functions, Scheduler, Pipes, Logs, SNS, SSM, Secrets Manager, Kinesis, MemoryDB, X-Ray and Resolver state to the request region

[vieiralucas]

Summary

Bug audit 2026-10-01 Tier 0.6 / 0.7 sweep: region-scope Step Functions, EventBridge Scheduler, EventBridge Pipes, CloudWatch Logs, SNS, SSM, Secrets Manager, Kinesis, MemoryDB, X-Ray and Route 53 Resolver. Stacked on the shared region-state infra in PR #2675 (branch fix-region-scoped-state, crates/fakecloud-core/src/multi_account.rs); merge that first. Combined into one PR to keep CI load down.

Every service here now keeps its state per (account, region): the same name coexists in two regions, lists and describes see only the request region, an ARN of another region is that service's NotFound, every ARN-addressed lookup or cross-service delivery uses the ARN's account and region, and pre-regional snapshots are split once on load by each record's ARN region (documented per service in reference/persistence.md, "Regional state migration"). No /_fakecloud/* wire shape changed, so no SDK changes.

Step Functions

• State machines, executions, activities, versions, aliases, map runs and task tokens per (account, region); name uniqueness and List* region-scoped. The interpreter records history, map runs, task tokens and child executions in the execution's own region; activities in the activity's region; StepFunctionsDelivery starts resolve the state machine by its ARN. Snapshot v3.

EventBridge Scheduler / Pipes

• Scheduler: every region has its own default group (an untouched region still lists/gets it); ticker, fire-once and post-fire deletes keyed by (account, region). Snapshot v2.
• Pipes: account -> region -> state; settle/recovery and CFN use the request/stack region; runner checkpoints live with their pipe (pipe ARN's account+region, not the source's). Snapshot v2.

CloudWatch Logs

• Every Logs resource per (account, region). EventBridge Logs targets, ECS/CodeBuild/Route 53 ingestion and the CFN provisioner write into the log group's own region. The segmented manifest migrates pre-regional metadata (v3). CloudwatchLogsDelivery::put_log_events now takes the region.

SNS

• Topics, subscriptions, platform applications, published messages and SMS settings per (account, region); ListSubscriptions / ListPlatformApplications no longer leak other regions; deliveries resolve the topic by its ARN; CFN subscriptions live in their topic's region; SmsDispatcher::send_sms takes the region (Cognito sends from its pool's region). Snapshot v3.

SSM

• Parameters, documents, maintenance windows, patch baselines, associations, OpsItems, inventory, sessions, etc. per region. The rewrite_arn_region hack is removed (ARNs stored with their real region, byte-identical on read). /aws/service/... public parameters in every region. Registered default patch baseline per region per OS. /aws/reference/secretsmanager/... reads the caller's account and region. read_parameter_value takes a region (ECS, CodeBuild callers updated). Snapshot v3.

Secrets Manager

• Secrets per region; another region's ARN -> ResourceNotFoundException. Replication is now real: replica regions get a read-only replica secret kept in sync with the primary; name clash -> Failed unless ForceOverwriteReplicaSecret; RemoveRegionsFromReplication deletes the replica; StopReplicationToReplica promotes it; deleting a primary with replicas is refused. read_secret_value takes a region. Snapshot v3.

Kinesis

• Streams, consumers, channels, resource policies per region; a stream ARN of another region no longer resolves to a same-name local stream. Delivery (DynamoDB destinations, Logs subscriptions, EventBridge/Scheduler/Pipes targets), the Lambda ESM poller and the Pipes source use the ARN's account+region. Snapshot v3.

MemoryDB / X-Ray / Route 53 Resolver

• MemoryDB: the retarget_default_arns hack is gone; each region seeds its own default user/ACL/parameter groups; multi-region clusters stay account-wide. Snapshot v2.
• X-Ray: groups, sampling rules (each region its own Default rule; ensure_default_rule re-pointing removed), encryption config, policies, traces per region. Snapshot v2.
• Route 53 Resolver: every resource regional; per-VPC configs keyed by VPC within the region; EC2 existence checks go through one region-aware helper. Snapshot v2.

Known pre-existing gap (not changed here)

• No CloudwatchLogsDelivery implementation is wired in the server, so API Gateway v2 access logs and Step Functions execution logging deliveries are dropped today; this PR only threads the region through the trait.

Test plan

• Unit (all pass): stepfunctions 262, scheduler 98, pipes 34, logs 347, sns 236, ssm 266, secretsmanager 150, kinesis 184, memorydb 30, xray 22, route53resolver 33, cloudformation 580, cognito, eventbridge, ecs/codebuild secret tests, fakecloud --bin 138. New tests per service: same name in two regions, region-scoped list/describe/delete, other-region ARN not found, untouched-region reads create nothing, legacy snapshot with two regions migrates correctly.
• E2E (all pass): new kinesis_regional, ssm_secretsmanager_regional; existing stepfunctions (81), sfn_sync, stepfunctions_paths/persistence/task_token, scheduler (+introspection/persistence), pipes (+execution/sources/targets), logs (54/55), logs_introspection, logs_persistence, eventbridge, sns, sns_persistence, ssm, secretsmanager (+kms/persistence/policies/patch tracking), kinesis, kinesis_persistence, xray, cloudformation_kinesis(_consumer), cloudformation_secretsmanager. Docker is unresponsive on this machine, so Docker-backed tests were not runnable: pipes_enrichment, logs_subscription_filter_invokes_lambda (both run real Lambda code), and the RDS step of region_scoped_arns.
• Conformance: stepfunctions/states/scheduler/pipes 27/27, logs 51/51, sns 42/42, ssm 69, secretsmanager 14, kinesis/memorydb/xray/route53resolver targeted runs pass.
• cargo clippy --workspace --all-targets -- -D warnings, cargo fmt