fix(cloudfront): fix validation for unresolved webAclId tokens

packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

@@ -663,6 +663,10 @@ export class Distribution extends Resource implements IDistribution {
   }
 
   private validateWebAclId(webAclId: string) {
+    if (Token.isUnresolved(webAclId)) {
+      // Cannot validate unresolved tokens or non-string values at synth-time.
+      return;
+    }
     if (webAclId.startsWith('arn:')) {
       const webAclRegion = Stack.of(this).splitArn(webAclId, ArnFormat.SLASH_RESOURCE_NAME).region;
       if (!Token.isUnresolved(webAclRegion) && webAclRegion !== 'us-east-1') {

packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts

@@ -6,7 +6,7 @@ import * as iam from '../../aws-iam';
 import * as kinesis from '../../aws-kinesis';
 import * as lambda from '../../aws-lambda';
 import * as s3 from '../../aws-s3';
-import { App, Aws, Duration, Stack } from '../../core';
+import { App, Aws, Duration, Stack, Token } from '../../core';
 import {
   AllowedMethods,
   CfnDistribution,
@@ -1432,6 +1432,18 @@ describe('attachWebAclId', () => {
         });
       }).toThrow(/WebACL for CloudFront distributions must be created in the us-east-1 region; received ap-northeast-1/);
     });
+
+    test('does not validate unresolved token webAclId', () => {
+      const origin = defaultOrigin();
+
+      const distribution = new Distribution(stack, 'MyDist', {
+        defaultBehavior: { origin },
+        webAclId: Token.asString({ Ref: 'SomeWebAcl' }), // unresolved token
+      });
+
+      // Should synthesize without error
+      Template.fromStack(stack);
+    });
   });
 });