(aws_cloudfront): (typescript requirement for distributions outside of us-east-1 with certificate not documented)

[janelletavares]

Describe the issue

I am writing up my app in Typescript. I don't know if any other language has the same behavior or the same kind of documentation situation... I did not check.

I have created a certificate in us-east-1 as required, but a distribution in another region. I reference this certificate by ARN in the distribution stack. When I deploy that distribution, I don't see the alias or the certificate I requested, nor an error. Through trial and error, it seems like I needed to declare a dependency between the certificate stack and distribution stack in order to get this to work as intended. I'm able to refer to all kinds of resources by ARN in other stacks without declaring a dependency, so this is unexpected. If this is indeed the intended behavior, please document that a dependency between the stacks is required. If there is some kind of temporary state to the code and the dependency won't always be required, it would also help to document that.

Modifying the example in the overview, it would look like...

// not us-east-1
import * as acm from 'aws-cdk-lib/aws-certificatemanager';

export class CertStack extends cdk.Stack {
declare const hostedZone: route53.HostedZone;
const myCertificate = acm.Certificate.CertificateFromArn(this, 'mySiteCert', 'arn');

declare const myBucket: s3.Bucket;
new cloudfront.Distribution(this, 'myDist', {
  defaultBehavior: { origin: new origins.S3Origin(myBucket) },
  domainNames: ['www.example.com'],
  certificate: myCertificate,
}); 
}

// always us-east-1
import * as acm from 'aws-cdk-lib/aws-certificatemanager';
import * as route53 from 'aws-cdk-lib/aws-route53';

export class DistributionStack extends cdk.Stack {
declare const hostedZone: route53.HostedZone;
const myCertificate = new acm.Certificate(this, 'mySiteCert', {
  domainName: 'www.example.com',
  validation: acm.CertificateValidation.fromDns(hostedZone),
});
}

const cert = new CertStack(app, 'cert-id', us-east-1-env);
const dist = new DistributionStack(app, 'cert-id', not-us-east-1-env-with-cross-region-references);
dist.addDependency(cert);

Links

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront-readme.html

[khushail]

Hi @janelletavares , thanks for reaching out.
I noticed that for using cross-region certs, one must declare crossRegionReferences as true. Example given here in Reference but I did not find any mention of addDependency(). Have you tried setting the property and using it as mentioned in the example here. I found some online post about the cross-region certs with cloudfornt distribution, might be helpful.

[janelletavares]

Hi @khushail thanks for your response and the pointers. Somehow, I missed that this feature was experimental. Unfortunately, my code has been working inconsistently. The link between the distribution and the certificate were working temporarily, and then it stopped. No combinations of crossRegionReferences and addDependency is making it work again. So it seems my issue is more of a bug than missing documentation at this point.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.