Cross-region resource sharing

[IndikaUdagedara]

❓ General Issue

The Question

Within the same app how can you share resources from different regions?

My specific use case is: A Cloudfront distribution requiring a ACM certificate from us-east-1, which has a origin load-balancer in another region. i.e.

• StackA (us-east-1) = Cloudfront + ACM
• StackB (us-west-1) = load-balancer and other resources
• load balancer DNS name needs to be passed from Stack B to A
  I could move Cloudfront to StackB but then I still have to pass certificate ARN from A to B. In both cases passed values don't have predictable names (DNS name/cert ARN) so can't think of a workaround (other than creating one stack first and copying the values by hand... )

When I try the above, I get the error:

Cross stack references are only supported for stacks deployed to the same environment or between nested stacks and their parent stack

Environment

• CDK CLI Version: 1.41
• Module Version: N/A
• OS: all
• Language: Typescript

Other information

There are couple of issues already posted (#7484, #7339) regarding cross-region/cross-account resource sharing within an app but couldn't find a solution to my problem. This could be a missing feature or unclear documentation.

The solution could be bit complicated if it's cross-account (due to having to create cross-account roles for example) but I feel there could be a simpler solution if the resources are in the same account. I was thinking about something like

• a custom resource in stack B which writes values to be exported cross-region to a s3 bucket
• a custom resource in stack A which reads from the same bucket

Would that work or is there another option? Appreciate guidance.

[skinny85]

Hey @IndikaUdagedara ,

thanks for opening the issue. In general, we only support cross account/region references when using conventional physical names. Unfortunately, if a resource does not allow you to set a physical name, things get difficult.

In this case, I wonder whether you couldn't use Route53 to give a well-known name to the LoadBalancer DNS, and kind of "simulate" a physical name that way?

[IndikaUdagedara]

In this case, I wonder whether you couldn't use Route53 to give a well-known name to the LoadBalancer DNS, and kind of "simulate" a physical name that way?

Thanks @skinny85. That's good idea, I'll try that.

What about in other cases e.g. sharing a certificate ARN? What is the recommended approach?

[skinny85]

In this case, I wonder whether you couldn't use Route53 to give a well-known name to the LoadBalancer DNS, and kind of "simulate" a physical name that way?

Thanks @skinny85. That's good idea, I'll try that.

What about in other cases e.g. sharing a certificate ARN? What is the recommended approach?

I don't know of a good way to do that unfortunately :/. Yes, you can write a custom resource that will read the output of the other stack in a cross region/account fashion, but then you're effectively hard-coding the name of the output, which is not great :/.

I wish I had better news in this case, but this is a problem that I've yet to see a great solution for.

[IndikaUdagedara]

Thanks @skinny85 - I got it working with your suggestion. Hope CDK will provide this natively soon!

[seanWLawrence]

I found this error when codeSigningConfiguration was setup on the edge function. Removing it worked.