Expose AWS connector setup, create, and verify - #1780

Check if this issue is valid — if so, understand the root cause and fix it. At packages/n8n-node/nodes/Probo/actions/accessReviewSource/probe.operation.ts, line 25:

<comment>This module is never registered by the access-review-source resource, so n8n omits the `probe` operation and cannot execute this new code. Register its operation option, description, and export in the resource index.</comment>

<file context>
@@ -0,0 +1,96 @@
+import { NodeOperationError } from 'n8n-workflow';
+import { proboApiRequest } from '../../GenericFunctions';
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Access Review Source ID',
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cmd/access-review/source/probe/probe.go, line 70:

<comment>The new command is never registered with the `source` command, so `prb access-review source probe` is unavailable. Register `probe.NewCmdProbe(f)` in the parent command.</comment>

<file context>
@@ -0,0 +1,136 @@
+	}
+)
+
+func NewCmdProbe(f *cmdutil.Factory) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "probe <id>",
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/n8n-node/nodes/Probo/actions/accessReviewSource/create.operation.ts, line 98:

<comment>When connector creation commits but its response is lost or contains a resolver error, this await exits before cleanup starts and leaves an unreferenced connector. Make the creation flow idempotent or reconcile the connector after unsuccessful responses so retries cannot accumulate orphaned connectors.</comment>

<file context>
@@ -0,0 +1,178 @@
+		awsRoleArn,
+	};
+
+	const connectorResponse = await proboApiRequest.call(this, createConnectorQuery, {
+		input: connectorInput,
+	});
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/server/api/console/v1/connector_connection_status.go, line 88:

<comment>When `SourceNeedsReconnect` fails, this log omits `connectorID`, so identical lookup or decryption failures cannot be attributed to a connector. Include the connector ID in this error log.</comment>

<file context>
@@ -0,0 +1,98 @@
+			return "", err
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot determine connector reconnect requirement", log.Error(err))
+
+		return "", gqlutils.Internal(ctx)
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cloud/aws/setup.go, line 139:

<comment>When a customer uses a valid IAM role path containing characters outside `[\w+=,.@-]`, `NewConnectorSettings` rejects the ARN even though AWS accepts it. Validate the ARN with AWS’s ARN parser and separately enforce only the supported partition and IAM-role constraints, or broaden the shared path grammar.</comment>

<file context>
@@ -0,0 +1,204 @@
+func NewConnectorSettings(roleARN string) (coredata.AWSConnectorSettings, error) {
+	roleARN = strings.TrimSpace(roleARN)
+
+	if _, err := arn.ParseRole(roleARN); err != nil {
+		if errors.Is(err, arn.ErrUnsupportedPartition) {
+			return coredata.AWSConnectorSettings{}, fmt.Errorf("cannot create aws connector: awsRoleArn is not a supported AWS partition")
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/awsx/arn/arn.go, line 50:

<comment>Existing IAM roles with valid path characters outside `\w+=,.@-` cannot be connected because `ParseRole` rejects their ARNs. Use IAM’s printable-ASCII path grammar while retaining the restricted 64-character class for the final role name, and keep the console validator in sync.</comment>

<file context>
@@ -32,7 +36,40 @@ const (
+	// RoleARNPattern is the IAM role ARN grammar. Partition is group 1,
+	// account is group 2, role name is group 3. The console field uses
+	// the same expression with the three supported partitions inlined.
+	RoleARNPattern = `arn:([^:]+):iam::([0-9]{12}):role(?:/[\w+=,.@-]+)*/([\w+=,.@-]{1,64})`
+)
+
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/connector/provider/registry_test.go, line 145:

<comment>The new `WorkloadIdentityExtraSettings` check in TestEveryProviderSettingsReachADialog is a tautology: WorkloadIdentityExtraSettings() already returns nil when SupportsWorkloadIdentity() is false (both derive from `WorkloadIdentity != nil`), so the assertion can never fail and pins nothing. Unlike the API-key sibling (whose SupportsAPIKey is false for a managed key), there is no case where a WLI settings list reaches an unoffered path. Either drop the block or assert a condition that the list length cannot already imply.</comment>

<file context>
@@ -141,6 +141,15 @@ func TestEveryProviderSettingsReachADialog(t *testing.T) {
 				)
 			}
+
+			if len(reg.WorkloadIdentityExtraSettings()) > 0 {
+				assert.Truef(
+					t,
</file context>