chore(kinesisfirehose): add validation for customTimeZone in S3BucketProps.

packages/aws-cdk-lib/aws-kinesisfirehose/lib/private/helpers.ts

@@ -183,3 +183,23 @@ export function createBackupConfig(scope: Construct, role: iam.IRole, props?: De
     dependables: [bucketGrant, ...(loggingDependables ?? [])],
   };
 }
+
+export function createTimezoneName(scope: Construct, timezone?: cdk.TimeZone): string | undefined {
+  if (!timezone) return undefined;
+
+  const timezoneName = timezone.timezoneName;
+  if (!/^$|^[a-zA-Z/_]+$/.test(timezoneName)) {
+    throw new cdk.ValidationError('Member must satisfy regular expression pattern: ^$|[a-zA-Z/_]+', scope);
+  }
+
+  const extendsNon3LetterIANATimezoneNames = [
+    cdk.TimeZone.ETC_UTC,
+    cdk.TimeZone.ETC_GMT,
+    cdk.TimeZone.FACTORY,
+  ].map((_timezone) => _timezone.timezoneName);
+  if (/^[A-Z]{3}$/.test(timezoneName) || extendsNon3LetterIANATimezoneNames.includes(timezoneName)) {
+    throw new cdk.ValidationError('Custom time zones are limited to UTC and non-3-letter IANA time zones', scope);
+  }
+
+  return timezoneName;
+}

packages/aws-cdk-lib/aws-kinesisfirehose/lib/s3-bucket.ts

@@ -4,7 +4,7 @@ import { DestinationBindOptions, DestinationConfig, IDestination } from './desti
 import { IInputFormat, IOutputFormat, SchemaConfiguration } from './record-format';
 import * as iam from '../../aws-iam';
 import * as s3 from '../../aws-s3';
-import { createBackupConfig, createBufferingHints, createEncryptionConfig, createLoggingOptions, createProcessingConfig } from './private/helpers';
+import { createBackupConfig, createBufferingHints, createEncryptionConfig, createLoggingOptions, createProcessingConfig, createTimezoneName } from './private/helpers';
 import * as cdk from '../../core';
 
 /**
@@ -25,6 +25,8 @@ export interface S3BucketProps extends CommonDestinationS3Props, CommonDestinati
   /**
    * The time zone you prefer.
    *
+   * Custom time zones are limited to UTC and non-3-letter IANA time zones and allowed patterns: `^$|[a-zA-Z/_]+`
+   *
    * @see https://docs.aws.amazon.com/firehose/latest/dev/s3-prefixes.html#timestamp-namespace
    *
    * @default - UTC
@@ -137,7 +139,7 @@ export class S3Bucket implements IDestination {
         errorOutputPrefix: this.props.errorOutputPrefix,
         prefix: this.props.dataOutputPrefix,
         fileExtension: this.props.fileExtension,
-        customTimeZone: this.props.timeZone?.timezoneName,
+        customTimeZone: createTimezoneName(scope, this.props.timeZone),
       },
       dependables: [bucketGrant, ...(loggingDependables ?? []), ...(backupDependables ?? [])],
     };

packages/aws-cdk-lib/aws-kinesisfirehose/test/s3-bucket.test.ts

@@ -855,19 +855,48 @@ describe('S3 destination', () => {
     });
   });
 
-  it('sets customTimeZone', () => {
-    const destination = new firehose.S3Bucket(bucket, {
-      role: destinationRole,
-      timeZone: cdk.TimeZone.ASIA_TOKYO,
+  describe('customTimeZone', () => {
+    it('sets customTimeZone', () => {
+      const destination = new firehose.S3Bucket(bucket, {
+        role: destinationRole,
+        timeZone: cdk.TimeZone.ASIA_TOKYO,
+      });
+      new firehose.DeliveryStream(stack, 'DeliveryStream', {
+        destination: destination,
+      });
+
+      Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
+        ExtendedS3DestinationConfiguration: {
+          CustomTimeZone: 'Asia/Tokyo',
+        },
+      });
     });
-    new firehose.DeliveryStream(stack, 'DeliveryStream', {
-      destination: destination,
+
+    it('throws when customTimeZone pattern does not match', () => {
+      const destination = new firehose.S3Bucket(bucket, {
+        role: destinationRole,
+        timeZone: cdk.TimeZone.ETC_GMT_MINUS_1,
+      });
+      expect(() => {
+        new firehose.DeliveryStream(stack, 'DeliveryStream', {
+          destination: destination,
+        });
+      }).toThrow('Member must satisfy regular expression pattern: ^$|[a-zA-Z/_]+');
     });
 
-    Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
-      ExtendedS3DestinationConfiguration: {
-        CustomTimeZone: 'Asia/Tokyo',
-      },
+    test.each([
+      cdk.TimeZone.EST,
+      cdk.TimeZone.ETC_UTC,
+    ])('throws when customTimeZone is 3-latter IANA time zones: %s', (timezone: cdk.TimeZone) => {
+      const destination = new firehose.S3Bucket(bucket, {
+        role: destinationRole,
+        timeZone: timezone,
+      });
+      expect(() => {
+        new firehose.DeliveryStream(stack, 'DeliveryStream', {
+          destination: destination,
+        });
+      }).toThrow('Custom time zones are limited to UTC and non-3-letter IANA time zones');
     });
   });