Cloudfront distribution ID not known when creating secret

One of the initials steps is to create a secret with a placeholder value. However, the secret name is:
"cloudfront/DISTRIBUTION_ID"
with DISTRIBUTION_ID to be substituted with the actual cloudfront distribution ID
doc: https://github.com/aws-samples/lambdaedge-openidconnect-samples/blob/master/docs/baseconfiguration.md

Previously the secret name was to be placed in a sm-key.txt file. Looks like this has changed and the secret is simply
"cloudfront/DISTRIBUTION_ID"

The code has been updated to look for this value. https://github.com/aws-samples/lambdaedge-openidconnect-samples/blob/master/src/js/auth.js#L241

However, the distribution_ID is not know when the secret is created. And, the secret ARN must be provided to deploy the stack (circular dependency).

Am I missing something?

Start with docs/baseconfiguration.md and the lookup in src/js/auth.js around line 241. Trace when the CloudFront distribution ID and secret ARN become available during stack deployment, then confirm a documented workflow that avoids the circular dependency.

Written by the indexing model from the issue text.