aws / aws/aws-cdk

(aws-cloudfront-origins): VpcOrigin ID collision in separate region of same AWS account

Open
#34,799 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-cloudfront-origins bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

`VpcOrigin.withApplicationLoadBalancer()`s with default settings are colliding and failing to create, in otherwise-same CDK apps/stacks deployed to different regions in the same AWS account.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

I'd expect to be able to deploy copies of a stack which creates a CloudFormation distribution, ELB, and VPC Origin to connect one to the other, to multiple regions in the same AWS Account.

I believe VPC Origins are treated as 'global resources' in the AWS Console, but map to an origin (like an ELB) which is in a region. Shouldn't the default behaviour of this construct be to generate a VPC Origin ID that's unique to the stack environment/context being built?

As far as I'm aware, this isn't a problem for e.g. CloudFront Distributions?

### Current Behavior

The second stack/region fails to deploy, with an error message like:

```
MyCoolStack | 166/188 | 7:20:26 AM | CREATE_FAILED | AWS::CloudFront::VpcOrigin | Path/To/CloudFront/Origin1/VpcOrigin (MyCoolStackLoadBalancerCloudFrontOrigin1VpcOrigin3DA297F9) Resource handler returned message: "Resource of type 'AWS::CloudFront::VpcOrigin' with identifier 'Another vpc origin with the same name already exists within the aws account. (Service: CloudFront, Status Code: 409, Request ID: 1443d547-3f89-44b8-97db-59ed26088048) (SDK Attempt Count: 1)' already exists." (RequestToken: ec840dba-af37-7339-8db3-5a2ef4968b93, HandlerErrorCode: AlreadyExists)
```

### Reproduction Steps

Our app creates an `elbv2.ApplicationLoadBalancer` and a CloudFront VPC Origin with default settings, like this:

```typescript
const cfOrigin = cloudfront_origins.VpcOrigin.withApplicationLoadBalancer(
this.loadBalancer,
{
protocolPolicy: cloudfront.OriginProtocolPolicy.HTTP_ONLY,
},
);
```

We're synthesizing the app with an explicitly-configured AWS Account ID and Region in each region we try to deploy it (`env` setting), because we have another resource that requires those and throws an error if they're not set/resolved.

Deploying in the first region works fine, but the second region fails with the above-mentioned error.

### Possible Solution

I haven't dug deep into it so far, but seems like the physical/unique ID generation logic should be made to be specific to AWS region and/or account, where present in the context?

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.184.1

### AWS CDK CLI version

2.1004.0

### Node.js Version

v22.15.1

### OS

macOS 15.5

### Language

TypeScript

### Language Version

5.6.3

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the TypeScript implementation of VpcOrigin.withApplicationLoadBalancer and inspect how its default VPC Origin name or identifier is generated from the explicitly configured account and region. Reproduce the deployment in two regions from the issue, then verify that both stacks create successfully without an AWS::CloudFront::VpcOrigin name collision.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.