core: pluggable/cross-region NestedStack

[rv2673]

Describe the feature

Extend NestedStack functionality to allow changing the resulting implementation(CfnStack) with other (custom)resource/construct to allow different implementation without having to workaround the token resolving mechanism that is done on stack level.

It would allow for a custom resource to be used, that deploys the stack cross region and exposing the stack outputs as outputs of custom resource without having to workaround or add additional writers/readers to pass value cross-region.

That functionality might be built into cdk or user can implement this functionality for their use case and hook into cdk through NestedStack hook.

Use Case

It is frustrating to work with cdk in cross-region scenarios and the currently builtin solutions are mostly experimental or finicky to use.

In cloudformation/cdk we can easily add nested stacks with the NestedStack construct. cdk handles the inputs and outputs, generating template, publishing it etc all transparently. In case of rollback the nested stack is also attempted to be rolled back.

For certain resources like Cloudfront certain referenced resources like lambda@edge, Waf, certificates all must be deployed in us-east-1. Cdk contains a lot of custom resources and workarounds to make certain constructs easier to use in a cross-region manner.

• crossRegion references (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.Stack.html#crossregionreferences)
  • Since this causes resources to be added during reference resolving, aspects like tagging are not applied which makes them hard to use in a restricted environment with tagging/permissionboundary requirements.
• EdgeFunction (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.experimental.EdgeFunction.html)
  • Experimental for a very long time. Also unable to use NodeJsFunction automatic packaging and bundling with esbuild having to reinvent the wheel.
• DnsValidateCertificate (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_certificatemanager.DnsValidatedCertificate.html)
  • Though deprecated in favor of Certificate for the dns validation being built in the default cfn resource, this one also had the cross region certificate creation functionality.
• Certain construct that have functionality builtin for their properties to be referenced cross region. Like secretsmanager Secret for use in policies. It the one that comes to mind, but have seen it in a few other resources)

Most of them are not easily extendable or are finicky to use, mainly because the reference resolving and linking is all on stack level and the resource need to create in mechanism to detect and workaround this resolving.

It would also open the cross-region functionality more easily for more resources than having such functionality having to be built in into every resource type.

Proposed Solution

Extend NestedStack so that a different resource than CfnStack like a custom resource that deploy stack in different region.

That custom resource might even be provider through cdk itself and be used if NestedStack is provided different env than the containing stack.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.92.0

Environment details (OS name and version, etc.)

Ubuntu 22.04

[peterwoodworth]

So basically, a custom resource provider that can handle deploying stacks of any arbitrary use cases cross-region/environment?

[rv2673]

So basically, a custom resource provider that can handle deploying stacks of any arbitrary use cases cross-region/environment?

Yes that would be basically be the idea. Not sure if we would want to support all arbitrary usecases from standard aws-cdk-lib.

But if endusers could override use of CfnStack in NestedStack with custom resource(with specific interface) they could implement resource supporting their usecase themselves if it is not supported by default.