aws-cloudfront: cdk incorrectly prevents attaching certificate when no aliases are given #29960
Description
Describe the bug
Hi, I am trying to follow the instructions on how to move an alias from an existing alias from one CloudFront distribution to another. The instructions says that I need to set up the target distribution with a certificate that includes the alternative domain name that I want to move: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-move-create-target
However when I try to set up the distribution with the certificate but without the alternative domain names (as directed in the instructions) I run into an error 'Must specify at least one domain name to use a certificate with a distribution' generated I think from this like of code within CDK:
aws-cdk/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts
Line 323 in 6fdc458
throw new Error('Must specify at least one domain name to use a certificate with a distribution');
It seems that CDK prevents me from adding a certificate unless I have a domain name; but that means I cannot follow the process for moving an alias from an old distribution to a new one. I can create a distribution with a certificate and no alias if I use the aws web console to do it; so I think CDK is wrong with this validation.
Expected Behavior
CDK should allow me to create a cloudfront distribution that has an ACM certificate attached but no aliases
Current Behavior
CDK raises an error message 'Must specify at least one domain name to use a certificate with a distribution' when I try to create a cloudfront distribution that has an ACM certificate attached but no aliases
Reproduction Steps
distribution = cloudfront.Distribution(
self,
"Distribution",
domain_names=[],
default_behavior=cloudfront.BehaviorOptions(
origin=origins.HttpOrigin(
dns_name,
protocol_policy=cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
origin_ssl_protocols=[
cloudfront.OriginSslPolicy.TLS_V1_1,
cloudfront.OriginSslPolicy.TLS_V1_2,
],
read_timeout=Duration.seconds(60),
),
viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
origin_request_policy=cloudfront.OriginRequestPolicy.ALL_VIEWER,
cache_policy=cache_policy,
allowed_methods=cloudfront.AllowedMethods.ALLOW_ALL,
compress=True,
),
price_class=cloudfront.PriceClass.PRICE_CLASS_200,
enabled=True,
log_includes_cookies=False,
log_bucket=logging_bucket,
enable_logging=True,
web_acl_id=waf_acl_arn,
ssl_support_method=cloudfront.SSLMethod.SNI,
certificate=my_certificate,
minimum_protocol_version=cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
)
Possible Solution
Remove the spurious validation check:
if ((props.domainNames ?? []).length === 0) {
throw new Error('Must specify at least one domain name to use a certificate with a distribution');
}
Additional Information/Context
No response
CDK CLI Version
2.137.0 (build bb90b4c)
Framework Version
No response
Node.js Version
v21.7.1
OS
Mac OS
Language
Python
Language Version
Python 3.11
Other information
No response