(aws-cloudfront): WebACL validate throws error `webAclId.startsWith` is not a function

[JustinLiang90]

Describe the bug

The error is introduced by the PR: #32252

When doing validation, it only consider the value is type of string, but it could also be Token if pass as reference .

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

CDK should build and deploy successfully.

Current Behavior

CDK throws webAclId.startsWith is not a function error during build and deploy.

Reproduction Steps

1. Create a distribution with webAclId parameter.
2. Passing token type value to webAclId, for example:

cfn.getNestedStack("WafStack").includedTemplate.getOutput("WebAclArn").value

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.188

Framework Version

No response

Node.js Version

18.20.4

OS

ubuntu

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Description:

When providing a WAF Web ACL ID as a Token or CloudFormation reference instead of a plain string, the CDK throws webAclId.startsWith is not a function during synth. This originates from a validation added in PR #32252, which assumes webAclId is always a string, ignoring unresolved tokens.

Current vs Expected

Root Cause Analysis

In the Distribution class implementation, the private method validateWebAclId() always calls .startsWith() on webAclId, regardless of whether it's a string or a Token.

Relevant snippet:

private validateWebAclId(webAclId: string) {
  if (webAclId.startsWith('arn:')) {
    const webAclRegion = Stack.of(this).splitArn(webAclId, ArnFormat.SLASH_RESOURCE_NAME).region;
    if (!Token.isUnresolved(webAclRegion) && webAclRegion !== 'us-east-1') {
      throw new ValidationError(`WebACL for CloudFront distributions must be created in the us-east-1 region; received ${webAclRegion}`, this);
    }
  }
}

• The method signature assumes webAclId is a string.
• When a CFN reference is passed in, it is treated as a Token.
• Token does not implement .startsWith(), leading to the runtime error during construct synthesis.

Possible Fixes/Solutions

Modify the validateWebAclId function to only perform string operations if the input is a resolvable string:

private validateWebAclId(webAclId: string) {
  if (Token.isUnresolved(webAclId)) {
    // Cannot validate unresolved tokens at synth-time.
    return;
  }
  if (webAclId.startsWith('arn:')) {
    const webAclRegion = Stack.of(this).splitArn(webAclId, ArnFormat.SLASH_RESOURCE_NAME).region;
    if (!Token.isUnresolved(webAclRegion) && webAclRegion !== 'us-east-1') {
      throw new ValidationError(
        `WebACL for CloudFront distributions must be created in the us-east-1 region; received ${webAclRegion}`,
        this
      );
    }
  }
}

This ensures .startsWith() is only called on fully resolved string values, avoiding the TypeError.

Making this a p1 and I'll submit a PR for it.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.