[core] StringParameter.valueFromLookup should return a token as dummy value

[lbjay]

❓ General Issue

The Question

I'm trying to re-use some resources from a different stack/app by having the 1st stack "publish" some ids/arns as ssm params, then the 2nd stack imports the resources by first getting their id values using StringParameter.valueFromLookup. This seems to work fine so far with, e.g., Vpc.fromLookup, Cluster.fromClusterAttributes, but trying to do the same with an IAM Role using Role.fromRoleArn fails because fromRoleArn expects a valid ARN and it's getting a placeholder, like 'dummy-value-blah-blah'.

Environment

• CDK CLI Version: 1.22.0 (build 309ac1b)
• Module Version: 1.22.0
• OS: Fedora 30
• Language: TypeScript

Other information

Here's a quick example to reproduce:

#!/usr/bin/env node
import { Stack, Construct, App, StackProps } from '@aws-cdk/core';
import { StringParameter } from '@aws-cdk/aws-ssm';
import { Role } from '@aws-cdk/aws-iam';
import { Vpc } from '@aws-cdk/aws-ec2';

const vpcIdParam = 'MyVpcId';
const roleArnParam = 'MyImportedRoleArn';

export class RoleFromArnStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const vpcId = StringParameter.valueFromLookup(this, vpcIdParam);
    const roleArn = StringParameter.valueFromLookup(this, roleArnParam);

    // this works fine
    const vpc = <Vpc>Vpc.fromLookup(this, 'ImportedVpc', { vpcId });

    // this fails because it expects a valid ARN
    const role = <Role>Role.fromRoleArn(this, 'ImportedRole', roleArn);
  }
}

const stackProps = {
  env: {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION,
  },
};

const app = new App();
new RoleFromArnStack(app, 'RoleFromArnStack', stackProps);
app.synth();

Bonus mystery!

If you comment out the const role = ... line, then run cdk synth, then uncomment and run again... it works!

[rix0rrr]

Yep, this is an issue, caused by the program running twice (once with the value, once without).

The "obvious" solution (returning a Token when we don't have the "real" value yet) is probably going to cause different issues with constructs that validate that their inputs can't be tokens, so it's not actually all that clear what the solution should be.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.