aws / aws/aws-cdk

core: pluggable/cross-region NestedStack

Open
#26,814 2 comments 4 reactions 0 assignees View on GitHub
@aws-cdk/core effort/large feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Extend NestedStack functionality to allow changing the resulting implementation(CfnStack) with other (custom)resource/construct to allow different implementation without having to workaround the token resolving mechanism that is done on stack level.

It would allow for a custom resource to be used, that deploys the stack cross region and exposing the stack outputs as outputs of custom resource without having to workaround or add additional writers/readers to pass value cross-region.

That functionality might be built into cdk or user can implement this functionality for their use case and hook into cdk through NestedStack hook.

### Use Case

It is frustrating to work with cdk in cross-region scenarios and the currently builtin solutions are mostly experimental or finicky to use.

In cloudformation/cdk we can easily add nested stacks with the NestedStack construct. cdk handles the inputs and outputs, generating template, publishing it etc all transparently. In case of rollback the nested stack is also attempted to be rolled back.

For certain resources like Cloudfront certain referenced resources like lambda@edge, Waf, certificates all must be deployed in us-east-1. Cdk contains a lot of custom resources and workarounds to make certain constructs easier to use in a cross-region manner.

- crossRegion references (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.Stack.html#crossregionreferences)
- Since this causes resources to be added during reference resolving, aspects like tagging are not applied which makes them hard to use in a restricted environment with tagging/permissionboundary requirements.
- EdgeFunction (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.experimental.EdgeFunction.html)
- Experimental for a very long time. Also unable to use NodeJsFunction automatic packaging and bundling with esbuild having to reinvent the wheel.
- DnsValidateCertificate (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_certificatemanager.DnsValidatedCertificate.html)
- Though deprecated in favor of Certificate for the dns validation being built in the default cfn resource, this one also had the cross region certificate creation functionality.
- Certain construct that have functionality builtin for their properties to be referenced cross region. Like secretsmanager Secret for use in policies. It the one that comes to mind, but have seen it in a few other resources)

Most of them are not easily extendable or are finicky to use, mainly because the reference resolving and linking is all on stack level and the resource need to create in mechanism to detect and workaround this resolving.

It would also open the cross-region functionality more easily for more resources than having such functionality having to be built in into every resource type.

### Proposed Solution

Extend NestedStack so that a different resource than [CfnStack](https://github.com/aws/aws-cdk/blob/eea12ea799973dff27aa4dedf03221e277ebaa0c/packages/aws-cdk-lib/core/lib/nested-stack.ts#L137) like a custom resource that deploy stack in different region.

That custom resource might even be provider through cdk itself and be used if NestedStack is provided different env than the containing stack.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.92.0

### Environment details (OS name and version, etc.)

Ubuntu 22.04

Contributor guide

Open the contributing guide

Research direction

Start with packages/aws-cdk-lib/core/lib/nested-stack.ts, especially the CfnStack implementation referenced in the issue. Trace how NestedStack handles inputs, outputs, template generation, and token resolution, then assess the proposed hook for replacing CfnStack with another resource or construct. Done would mean a supported alternate implementation that can deploy cross-region and expose nested-stack outputs without extra readers or writers.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.