[satyakigh]

Summary

• Remove the path-based E3511 IAM role ARN rule from the CEL and Rego engines, the rule registry, and the cfn-lint data extractor.
• Add AWS::IAM::Role.Name format validation as E1165 using IAM's role-name and optional-path constraints.
• Preserve branch-specific format diagnostics when a scalar anyOf fails, so invalid Batch role references report F3017, E1156, and E1165 at the same property.

Why

E3511 duplicated the schema-backed AWS::IAM::Role.Arn format rule (E1156) with a hardcoded property list and a different regular expression. It could report the same malformed ARN twice. It also rejected valid role names and path-prefixed role names on the two AWS::Batch::ComputeEnvironment properties that accept either an ARN or a name.

The enhanced schemas now express the contract directly:

Property	Schema constraint	Accepted values
AWS::Backup::BackupSelection BackupSelection/IamRoleArn	format: AWS::IAM::Role.Arn	ARN
AWS::ECS::TaskDefinition ExecutionRoleArn	format: AWS::IAM::Role.Arn	ARN
AWS::EC2::SpotFleet SpotFleetRequestConfigData/IamFleetRole	format: AWS::IAM::Role.Arn	ARN
AWS::S3::Bucket ReplicationConfiguration/Role	format: AWS::IAM::Role.Arn	ARN
AWS::Batch::ComputeEnvironment ServiceRole	anyOf: [Role.Arn, Role.Name]	ARN or name
AWS::Batch::ComputeEnvironment ComputeResources/SpotIamFleetRole	anyOf: [Role.Arn, Role.Name]	ARN or name

Related work

• Resolves the equivalent upstream problem described in cfn-lint issue #4941.
• Mirrors the merged removal in cfn-lint PR #4942.
• Consumes the role constraints added by resource-provider-enhanced-schemas PR #74.
• Retains the partition behavior covered by local issue Enumerating partitions in rule sets is opting into to future maintenance #36.

Validation behavior changes

• E3511 is removed.
• Invalid values on ARN-only properties continue to report E1156.
• Batch role properties accept bare names, path-prefixed names, and role ARNs.
• A Batch value that matches neither alternative reports the anyOf failure (F3017) and both failed format branches (E1156 and E1165), matching cfn-lint's schema reporting.
• Unresolved intrinsic values remain deferred rather than producing false positives.
• IAM role ARNs continue to accept any aws-prefixed partition without a fixed partition allowlist.

Checklist

• Expected behavior is supported by CloudFormation and service evidence, and all three engine selectors agree.
• The code follows the contributing guide and repository code-quality conventions.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.