aws-wafv2: Creating WAF with condition gives error: "Template format error: Unresolved resource dependencies [XXXX] in the Resources block of the template"
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
In my main stack located in the ap-southeast-2 region, I have a CloudFront distribution, which operates globally. This setup is functioning correctly.
However, I faced difficulties creating an AWS WAF in the same stack because WAF needs to be in a different stack due to regional constraints. I resolved this by creating a separate stack for the WAF and enabled crossRegionReferences in the main stack to reference the WAF.
```
// override env for my waf stack
env: { region: 'us-east-1' }
```
When the condition to enable the WAF is true, everything works as expected. But when I set the condition to false, I receive an error: Template format error: Unresolved resource dependencies [XXXX] in the Resources block of the template. Upon reviewing the synthesized template, I see that the Lambda function and the role were created without considering the condition. I believe this is the issue? The lambda and the role should also have condition attached to it? Example of synth temp is
```
CustomCrossRegionExportWriterCustomResourceProviderHandlerXXXX": {
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"S3Bucket": {
"Fn::Sub": "XXXXXX-us-east-1"
},
"S3Key": "XXXX.zip"
......
},
```
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Version
_No response_
### Expected Behavior
When the condition is false, the stack should deploy successfully, and no resources should be created.
### Current Behavior
Throws and error "Template format error: Unresolved resource dependencies [XXXX] in the Resources block of the template"
### Reproduction Steps
- Create Cloudfront in your main stack. ('ap-southeast-2')
- Create WAF in new stack , set env region as us-east-1
- Enable crossRegionReferences on your consuming stack
```
const wafStack = new WafStack(
app,
`waf-stack`,
{
createWAF: false,
},
{
env: { region: 'us-east-1' },
}
);
new MainStack(
app,
`main-stack`,
{
webAclArnExport: wafStack?.webAclArnOutput,
},
{
env: {
region: process.env.CDK_DEFAULT_REGION,
},
crossRegionReferences: true,
}
);
// WAF stack
const isWafEnabled = new cdk.CfnCondition(this, 'waf', {
expression: cdk.Fn.conditionEquals(
'false',
'true'
),
});
const webAcl = new wafv2.CfnWebACL(this, 'web-acl', {
scope: 'CLOUDFRONT',
...
}
webAcl.cfnOptions.condition = isWafEnabled;
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.155.0
### Framework Version
_No response_
### Node.js Version
v20.11.0
### OS
Sonoma
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Reproduce the ap-southeast-2 and us-east-1 stacks with crossRegionReferences enabled and inspect the synthesized template, especially CustomCrossRegionExportWriterCustomResourceProviderHandlerXXXX and the WAF condition. Trace how the condition is applied to the WAF and its cross-region resource dependencies. Done means deploying with the condition false succeeds without creating the WAF or leaving unresolved resource dependencies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100