aws · mergify · Aug 22, 2024 · Aug 21, 2024 · Aug 21, 2024 · Aug 22, 2024
diff --git a/CHANGELOG.v2.alpha.md b/CHANGELOG.v2.alpha.md
@@ -2,7 +2,7 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https:/conventional-changelog/standard-version) for commit guidelines.
 
-## [2.154.0-alpha.0](https:/aws/aws-cdk/compare/v2.153.0-alpha.0...v2.154.0-alpha.0) (2024-08-21)
+## [2.154.0-alpha.0](https:/aws/aws-cdk/compare/v2.153.0-alpha.0...v2.154.0-alpha.0) (2024-08-22)
 
 
 ### Features

diff --git a/CHANGELOG.v2.md b/CHANGELOG.v2.md
@@ -2,7 +2,7 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https:/conventional-changelog/standard-version) for commit guidelines.
 
-## [2.154.0](https:/aws/aws-cdk/compare/v2.153.0...v2.154.0) (2024-08-21)
+## [2.154.0](https:/aws/aws-cdk/compare/v2.153.0...v2.154.0) (2024-08-22)
 
 
 ### Features
@@ -28,6 +28,7 @@ All notable changes to this project will be documented in this file. See [standa
 
 ### Bug Fixes
 
+* **cloudfront:** requirement of domainNames prevents moving a domain name between distributions ([#31001](https:/aws/aws-cdk/issues/31001)) ([acdf7d3](https:/aws/aws-cdk/commit/acdf7d3a1ffe2cbc8239cd0b788dc47b99e35184)), closes [#29960](https:/aws/aws-cdk/issues/29960) [#29329](https:/aws/aws-cdk/issues/29329)
 * **elasticloadbalancingv2-targets:** add AlbListenerTarget for NLBs, deprecate AlbTarget due to ALB listener race conditions ([#17208](https:/aws/aws-cdk/issues/17208)) ([#30396](https:/aws/aws-cdk/issues/30396)) ([1fca1e5](https:/aws/aws-cdk/commit/1fca1e5b92ba760a33652f39c2345f6aa1eaa9f7)), closes [/github.com/aws/aws-cdk/issues/17208#issuecomment-1681475590](https:/aws/aws/aws-cdk/issues/17208/issues/issuecomment-1681475590)
 * **lambda:** validate localMountPath format and length ([#31019](https:/aws/aws-cdk/issues/31019)) ([c159e77](https:/aws/aws-cdk/commit/c159e77ab34701fc6780b9501f1692fbf2366b04))
 * **vpc-v2:** fixing default scope id ([#31102](https:/aws/aws-cdk/issues/31102)) ([0007a29](https:/aws/aws-cdk/commit/0007a29714cf04abb307845874dde27c813d45dd))

diff --git a/packages/aws-cdk-lib/aws-cloudfront/README.md b/packages/aws-cdk-lib/aws-cloudfront/README.md
@@ -115,6 +115,16 @@ new cloudfront.Distribution(this, 'myDist', {
 });
 ```
 
+#### Moving an alternate domain name to a different distribution
+
+When you try to add an alternate domain name to a distribution but the alternate domain name is already in use on a different distribution, you get a `CNAMEAlreadyExists` error (One or more of the CNAMEs you provided are already associated with a different resource).
+
+In that case, you might want to move the existing alternate domain name from one distribution (the source distribution) to another (the target distribution). The following steps are an overview of the process. For more information, see [Moving an alternate domain name to a different distribution](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/alternate-domain-names-move.html).
+
+1. Deploy the stack with the target distribution. The `certificate` property must be specified but the `domainNames` should be absent.
+2. Move the alternate domain name by running CloudFront `associate-alias` command. For the example and preconditions, see the AWS documentation above.
+3. Specify the `domainNames` property with the alternative domain name, then deploy the stack again to resolve the drift at the alternative domain name.
+
 #### Cross Region Certificates
 
 > **This feature is currently experimental**

diff --git a/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts b/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts
@@ -129,7 +129,10 @@ export interface DistributionProps {
  *
  * If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name,
  * you can add an alternate domain name to your distribution. If you attach a certificate to the distribution,
- * you must add (at least one of) the domain names of the certificate to this list.
+ * you should add (at least one of) the domain names of the certificate to this list.
+ *
+ * When you want to move a domain name between distributions, you can associate a certificate without specifying any domain names.
+ * For more information, see the _Moving an alternate domain name to a different distribution_ section in the README.
  *
  * @default - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
  */
@@ -318,10 +321,6 @@ export class Distribution extends Resource implements IDistribution {
  if (!Token.isUnresolved(certificateRegion) && certificateRegion !== 'us-east-1') {
  throw new Error(`Distribution certificates must be in the us-east-1 region and the certificate you provided is in ${certificateRegion}.`);
  }
-
- if ((props.domainNames ?? []).length === 0) {
- throw new Error('Must specify at least one domain name to use a certificate with a distribution');
- }
  }
 
  const originId = this.addOrigin(props.defaultBehavior.origin);

diff --git a/packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts b/packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts
@@ -457,23 +457,22 @@ describe('certificates', () => {
  }).toThrow(/Distribution certificates must be in the us-east-1 region and the certificate you provided is in eu-west-1./);
  });
 
- test('adding a certificate without a domain name throws', () => {
+ test('adding a certificate without a domain name', () => {
  const certificate = acm.Certificate.fromCertificateArn(stack, 'Cert', 'arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012');
 
- expect(() => {
- new Distribution(stack, 'Dist1', {
- defaultBehavior: { origin: defaultOrigin() },
- certificate,
- });
- }).toThrow(/Must specify at least one domain name/);
+ new Distribution(stack, 'Dist1', {
+ defaultBehavior: { origin: defaultOrigin() },
+ certificate,
+ });
 
- expect(() => {
- new Distribution(stack, 'Dist2', {
- defaultBehavior: { origin: defaultOrigin() },
- domainNames: [],
- certificate,
- });
- }).toThrow(/Must specify at least one domain name/);
+ Template.fromStack(stack).hasResourceProperties('AWS::CloudFront::Distribution', {
+ DistributionConfig: {
+ Aliases: Match.absent(),
+ ViewerCertificate: {
+ AcmCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012',
+ },
+ },
+ });
  });
 
  test('use the TLSv1.2_2021 security policy by default', () => {

diff --git a/packages/aws-cdk-lib/custom-resources/lib/custom-resource-config/custom-resource-config.ts b/packages/aws-cdk-lib/custom-resources/lib/custom-resource-config/custom-resource-config.ts
@@ -12,6 +12,7 @@ export const CUSTOM_RESOURCE_SINGLETON_LOG_RETENTION = 'aws:cdk:is-custom-resour
 
 /**
  * Manages AWS-vended Custom Resources
+ *
  * This feature is currently experimental.
  */
 export class CustomResourceConfig {
@@ -42,6 +43,8 @@ export class CustomResourceConfig {
 
 /**
  * Manages log retention for AWS-vended custom resources.
+ *
+ * This feature is currently experimental.
  */
 export class CustomResourceLogRetention implements IAspect {
  private readonly logRetention: logs.RetentionDays;
@@ -89,6 +92,8 @@ export class CustomResourceLogRetention implements IAspect {
 
 /**
  * Manages removal policy for AWS-vended custom resources.
+ *
+ * This feature is currently experimental.
  */
 export class CustomResourceRemovalPolicy implements IAspect {
  private readonly removalPolicy: RemovalPolicy;

diff --git a/packages/aws-cdk-lib/region-info/build-tools/fact-tables.ts b/packages/aws-cdk-lib/region-info/build-tools/fact-tables.ts
@@ -528,7 +528,7 @@ export const CLOUDWATCH_LAMBDA_INSIGHTS_ARNS: { [key: string]: any } = {
  'ap-southeast-2': 'arn:aws:lambda:ap-southeast-2:580247275435:layer:LambdaInsightsExtension:52',
  'ap-northeast-1': 'arn:aws:lambda:ap-northeast-1:580247275435:layer:LambdaInsightsExtension:79',
  'ca-central-1': 'arn:aws:lambda:ca-central-1:580247275435:layer:LambdaInsightsExtension:51',
- // 'ca-west-1': 'arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:12',
+ 'ca-west-1': 'arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:12',
  'cn-north-1': 'arn:aws-cn:lambda:cn-north-1:488211338238:layer:LambdaInsightsExtension:42',
  'cn-northwest-1': 'arn:aws-cn:lambda:cn-northwest-1:488211338238:layer:LambdaInsightsExtension:42',
  'eu-central-1': 'arn:aws:lambda:eu-central-1:580247275435:layer:LambdaInsightsExtension:52',
@@ -591,7 +591,7 @@ export const CLOUDWATCH_LAMBDA_INSIGHTS_ARNS: { [key: string]: any } = {
  'ap-southeast-2': 'arn:aws:lambda:ap-southeast-2:580247275435:layer:LambdaInsightsExtension:51',
  'ap-northeast-1': 'arn:aws:lambda:ap-northeast-1:580247275435:layer:LambdaInsightsExtension:78',
  'ca-central-1': 'arn:aws:lambda:ca-central-1:580247275435:layer:LambdaInsightsExtension:50',
- // 'ca-west-1': 'arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:11',
+ 'ca-west-1': 'arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:11',
  'cn-north-1': 'arn:aws-cn:lambda:cn-north-1:488211338238:layer:LambdaInsightsExtension:41',
  'cn-northwest-1': 'arn:aws-cn:lambda:cn-northwest-1:488211338238:layer:LambdaInsightsExtension:41',
  'eu-central-1': 'arn:aws:lambda:eu-central-1:580247275435:layer:LambdaInsightsExtension:51',
@@ -652,7 +652,7 @@ export const CLOUDWATCH_LAMBDA_INSIGHTS_ARNS: { [key: string]: any } = {
  'ap-southeast-2': 'arn:aws:lambda:ap-southeast-2:580247275435:layer:LambdaInsightsExtension:49',
  'ap-northeast-1': 'arn:aws:lambda:ap-northeast-1:580247275435:layer:LambdaInsightsExtension:76',
  'ca-central-1': 'arn:aws:lambda:ca-central-1:580247275435:layer:LambdaInsightsExtension:48',
- // 'ca-west-1': 'arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:9',
+ 'ca-west-1': 'arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:9',
  'cn-north-1': 'arn:aws-cn:lambda:cn-north-1:488211338238:layer:LambdaInsightsExtension:39',
  'cn-northwest-1': 'arn:aws-cn:lambda:cn-northwest-1:488211338238:layer:LambdaInsightsExtension:39',
  'eu-central-1': 'arn:aws:lambda:eu-central-1:580247275435:layer:LambdaInsightsExtension:49',
@@ -711,7 +711,7 @@ export const CLOUDWATCH_LAMBDA_INSIGHTS_ARNS: { [key: string]: any } = {
  'ap-southeast-2': 'arn:aws:lambda:ap-southeast-2:580247275435:layer:LambdaInsightsExtension:45',
  'ap-northeast-1': 'arn:aws:lambda:ap-northeast-1:580247275435:layer:LambdaInsightsExtension:72',
  'ca-central-1': 'arn:aws:lambda:ca-central-1:580247275435:layer:LambdaInsightsExtension:44',
- // 'ca-west-1': 'arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:4',
+ 'ca-west-1': 'arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:4',
  'cn-north-1': 'arn:aws-cn:lambda:cn-north-1:488211338238:layer:LambdaInsightsExtension:36',
  'cn-northwest-1': 'arn:aws-cn:lambda:cn-northwest-1:488211338238:layer:LambdaInsightsExtension:36',
  'eu-central-1': 'arn:aws:lambda:eu-central-1:580247275435:layer:LambdaInsightsExtension:45',

diff --git a/packages/aws-cdk-lib/region-info/test/__snapshots__/region-info.test.ts.snap b/packages/aws-cdk-lib/region-info/test/__snapshots__/region-info.test.ts.snap
@@ -664,10 +664,10 @@ exports[`built-in data is correct 1`] = `
  "1.0.143.0": undefined,
  "1.0.178.0": undefined,
  "1.0.229.0": undefined,
- "1.0.273.0": undefined,
- "1.0.275.0": undefined,
- "1.0.295.0": undefined,
- "1.0.317.0": undefined,
+ "1.0.273.0": "arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:4",
+ "1.0.275.0": "arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:9",
+ "1.0.295.0": "arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:11",
+ "1.0.317.0": "arn:aws:lambda:ca-west-1:946466191631:layer:LambdaInsightsExtension:12",
  "1.0.54.0": undefined,
  "1.0.86.0": undefined,
  "1.0.89.0": undefined,