aws / aws/aws-cdk

aws-wafv2: Creating WAF with condition gives error: "Template format error: Unresolved resource dependencies [XXXX] in the Resources block of the template"

Open
#31,459 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-wafv2 bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

In my main stack located in the ap-southeast-2 region, I have a CloudFront distribution, which operates globally. This setup is functioning correctly.

However, I faced difficulties creating an AWS WAF in the same stack because WAF needs to be in a different stack due to regional constraints. I resolved this by creating a separate stack for the WAF and enabled crossRegionReferences in the main stack to reference the WAF.
```
// override env for my waf stack
env: { region: 'us-east-1' }
```

When the condition to enable the WAF is true, everything works as expected. But when I set the condition to false, I receive an error: Template format error: Unresolved resource dependencies [XXXX] in the Resources block of the template. Upon reviewing the synthesized template, I see that the Lambda function and the role were created without considering the condition. I believe this is the issue? The lambda and the role should also have condition attached to it? Example of synth temp is
```
CustomCrossRegionExportWriterCustomResourceProviderHandlerXXXX": {
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"S3Bucket": {
"Fn::Sub": "XXXXXX-us-east-1"
},
"S3Key": "XXXX.zip"
......
},
```
### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

When the condition is false, the stack should deploy successfully, and no resources should be created.

### Current Behavior

Throws and error "Template format error: Unresolved resource dependencies [XXXX] in the Resources block of the template"

### Reproduction Steps
- Create Cloudfront in your main stack. ('ap-southeast-2')
- Create WAF in new stack , set env region as us-east-1
- Enable crossRegionReferences on your consuming stack
```
const wafStack = new WafStack(
app,
`waf-stack`,
{
createWAF: false,
},
{
env: { region: 'us-east-1' },
}
);

new MainStack(
app,
`main-stack`,
{
webAclArnExport: wafStack?.webAclArnOutput,
},
{
env: {
region: process.env.CDK_DEFAULT_REGION,
},
crossRegionReferences: true,
}
);

// WAF stack
const isWafEnabled = new cdk.CfnCondition(this, 'waf', {
expression: cdk.Fn.conditionEquals(
'false',
'true'
),
});

const webAcl = new wafv2.CfnWebACL(this, 'web-acl', {
scope: 'CLOUDFRONT',
...
}

webAcl.cfnOptions.condition = isWafEnabled;
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.155.0

### Framework Version

_No response_

### Node.js Version

v20.11.0

### OS

Sonoma

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the ap-southeast-2 and us-east-1 stacks with crossRegionReferences enabled and inspect the synthesized template, especially CustomCrossRegionExportWriterCustomResourceProviderHandlerXXXX and the WAF condition. Trace how the condition is applied to the WAF and its cross-region resource dependencies. Done means deploying with the condition false succeeds without creating the WAF or leaving unresolved resource dependencies.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.