feat(aws): add the ISO partitions to the AWS service region matrix

The region matrix only carried aws, aws-cn, aws-eusc and aws-us-gov, so
asking for the regions of a service in an ISO partition had no data to
answer with. That is the reason GovCloud works and the ISO partitions do
not: the code paths are the same, only the data is missing.

The generator now fills aws-iso, aws-iso-b, aws-iso-e and aws-iso-f from
the endpoints data bundled with botocore, which needs no credentials and
no network, so it also works for partitions the bot can never reach. The
SSM pass is left untouched: it remains the only source with data for the
existing partitions, and regenerating them yields no change at all.

Services are keyed by endpoint prefix in the botocore data and by service
name in the matrix, so the mapping is derived from the service models
themselves instead of being written by hand. Cost Explorer is renamed
explicitly, and the streaming endpoint of Transcribe is ignored because
the service is already resolved through its own prefix. An endpoint
prefix that resolves to neither aborts the run, so a service newly
available in a partition is noticed instead of silently dropped.

Every service keeps carrying every partition, empty where the service is
not available, as it already did for the existing partitions.

The bot install is pinned to the version in pyproject.toml, since the
bundled endpoints data is now itself a source and has to be deterministic.

Author: StylusFrost

.github/workflows/sdk-refresh-aws-services-regions.yml

@@ -44,7 +44,10 @@ jobs:
           cache: 'pip'
 
       - name: Install dependencies
-        run: pip install boto3
+        # Pinned to the versions in pyproject.toml: the ISO partitions region
+        # data comes from the endpoints.json bundled with botocore, so the
+        # botocore version is itself a data source and must be deterministic
+        run: pip install boto3==1.40.61 botocore==1.40.61
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1

prowler/changelog.d/aws-iso-partitions.added.md

@@ -0,0 +1 @@
+AWS ISO partitions (`aws-iso`, `aws-iso-b`, `aws-iso-e` and `aws-iso-f`) to the AWS service/region matrix, sourced from the endpoints data bundled with botocore, so services are now scanned in the ISO partitions instead of being silently skipped