An ARN is a non-opaque, constructible identifier, apparently by design. They aren't at all likely to change the documented rules for the S3 ARN format. The cn-north-1 region is special case, as is GovCloud, because those are completely cordoned off from the global aws partition, not accessible with the same sets of keys. If you're working in multiple partitions, you have to know which partition you're dealing with.