From b69d21c0856573035adeb0488d680452e4ac85ed Mon Sep 17 00:00:00 2001
From: "igor.grzankowski" <@splunk.com>
Date: Tue, 21 Oct 2025 16:11:37 +0200
Subject: [PATCH 1/2] Fix s3 regex

---
 pkg/splunk/client/awss3client.go      |  2 +-
 pkg/splunk/client/awss3client_test.go | 90 +++++++++++++++++++++++++++
 2 files changed, 91 insertions(+), 1 deletion(-)

diff --git a/pkg/splunk/client/awss3client.go b/pkg/splunk/client/awss3client.go
index dab7f368a..9a5d8d1da 100644
--- a/pkg/splunk/client/awss3client.go
+++ b/pkg/splunk/client/awss3client.go
@@ -62,7 +62,7 @@ type AWSS3Client struct {
 	Downloader         SplunkAWSDownloadClient
 }
 
-var regionRegex = ".*.s3[-,.]([a-z]+-[a-z]+-[0-9]+)\\..*amazonaws.com"
+var regionRegex = ".*.s3[-,.]([a-z]+-[a-z]+(?:-[a-z]+)?-[0-9]+)\\..*amazonaws.com"
 
 // GetRegion extracts the region from the endpoint field
 func GetRegion(ctx context.Context, endpoint string, region *string) error {
diff --git a/pkg/splunk/client/awss3client_test.go b/pkg/splunk/client/awss3client_test.go
index a6af8efa2..b145c9e5a 100644
--- a/pkg/splunk/client/awss3client_test.go
+++ b/pkg/splunk/client/awss3client_test.go
@@ -69,6 +69,96 @@ func TestGetTLSVersion(t *testing.T) {
 		getTLSVersion(&tr)
 	}
 }
+
+func TestGetRegion(t *testing.T) {
+	ctx := context.TODO()
+
+	tests := []struct {
+		name           string
+		endpoint       string
+		expectedRegion string
+		expectError    bool
+	}{
+		{
+			name:           "Standard 3-part region - us-west-2",
+			endpoint:       "https://s3.us-west-2.amazonaws.com",
+			expectedRegion: "us-west-2",
+			expectError:    false,
+		},
+		{
+			name:           "Standard 3-part region - eu-west-1",
+			endpoint:       "https://s3-eu-west-1.amazonaws.com",
+			expectedRegion: "eu-west-1",
+			expectError:    false,
+		},
+		{
+			name:           "GovCloud 4-part region - us-gov-west-1",
+			endpoint:       "https://s3.us-gov-west-1.amazonaws.com",
+			expectedRegion: "us-gov-west-1",
+			expectError:    false,
+		},
+		{
+			name:           "GovCloud 4-part region - us-gov-east-1",
+			endpoint:       "https://s3-us-gov-east-1.amazonaws.com",
+			expectedRegion: "us-gov-east-1",
+			expectError:    false,
+		},
+		{
+			name:           "ISO region - us-iso-east-1",
+			endpoint:       "https://s3.us-iso-east-1.amazonaws.com",
+			expectedRegion: "us-iso-east-1",
+			expectError:    false,
+		},
+		{
+			name:           "ISOB region - us-isob-east-1",
+			endpoint:       "https://s3.us-isob-east-1.amazonaws.com",
+			expectedRegion: "us-isob-east-1",
+			expectError:    false,
+		},
+		{
+			name:           "With bucket prefix",
+			endpoint:       "https://mybucket.s3.us-west-2.amazonaws.com",
+			expectedRegion: "us-west-2",
+			expectError:    false,
+		},
+		{
+			name:           "GovCloud with bucket prefix",
+			endpoint:       "https://mybucket.s3.us-gov-west-1.amazonaws.com",
+			expectedRegion: "us-gov-west-1",
+			expectError:    false,
+		},
+		{
+			name:        "Invalid endpoint - no region",
+			endpoint:    "https://s3.amazonaws.com",
+			expectError: true,
+		},
+		{
+			name:        "Invalid endpoint - non-AWS",
+			endpoint:    "https://storage.googleapis.com",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var region string
+			err := GetRegion(ctx, tt.endpoint, &region)
+
+			if tt.expectError {
+				if err == nil {
+					t.Errorf("Expected error for endpoint %s, but got none", tt.endpoint)
+				}
+			} else {
+				if err != nil {
+					t.Errorf("Unexpected error for endpoint %s: %v", tt.endpoint, err)
+				}
+				if region != tt.expectedRegion {
+					t.Errorf("Expected region %s, got %s for endpoint %s", tt.expectedRegion, region, tt.endpoint)
+				}
+			}
+		})
+	}
+}
 func TestNewAWSS3Client(t *testing.T) {
 	ctx := context.TODO()
 	fn := InitAWSClientWrapper

From 18f97d6bc0021c137f04bd4b2da4d9d69beda11a Mon Sep 17 00:00:00 2001
From: "igor.grzankowski" <@splunk.com>
Date: Tue, 21 Oct 2025 17:10:25 +0200
Subject: [PATCH 2/2] Fix

---
 pkg/splunk/client/awss3client.go      | 2 +-
 pkg/splunk/client/awss3client_test.go | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkg/splunk/client/awss3client.go b/pkg/splunk/client/awss3client.go
index 9a5d8d1da..b35d989c8 100644
--- a/pkg/splunk/client/awss3client.go
+++ b/pkg/splunk/client/awss3client.go
@@ -62,7 +62,7 @@ type AWSS3Client struct {
 	Downloader         SplunkAWSDownloadClient
 }
 
-var regionRegex = ".*.s3[-,.]([a-z]+-[a-z]+(?:-[a-z]+)?-[0-9]+)\\..*amazonaws.com"
+var regionRegex = ".*.s3[-,.]([a-z]+-[a-z]+(?:-[a-z]+)?-[0-9]+)\\..*amazonaws\\.com"
 
 // GetRegion extracts the region from the endpoint field
 func GetRegion(ctx context.Context, endpoint string, region *string) error {
diff --git a/pkg/splunk/client/awss3client_test.go b/pkg/splunk/client/awss3client_test.go
index b145c9e5a..5df04182c 100644
--- a/pkg/splunk/client/awss3client_test.go
+++ b/pkg/splunk/client/awss3client_test.go
@@ -137,6 +137,11 @@ func TestGetRegion(t *testing.T) {
 			endpoint:    "https://storage.googleapis.com",
 			expectError: true,
 		},
+		{
+			name:        "Invalid endpoint - malformed domain",
+			endpoint:    "https://s3.us-west-2.amazonawsXcom",
+			expectError: true,
+		},
 	}
 
 	for _, tt := range tests {