-
Notifications
You must be signed in to change notification settings - Fork 4.5k
certificatemanager: Conditions in domainName are being rejected because their string representation is > 64 characters #36832
Copy link
Copy link
Closed
Labels
@aws-cdk/coreRelated to core CDK functionalityRelated to core CDK functionalitybugThis issue is a bug.This issue is a bug.effort/mediumMedium work item – several days of effortMedium work item – several days of effortp0potential-regressionMarking this issue as a potential regression to be checked by team memberMarking this issue as a potential regression to be checked by team member
Description
Describe the bug
When depending on software.amazon.awscdk:aws-cdk-lib:2.233.0 & software.amazon.awscdk:cdk-asset-awscli-v1:2.2.242 it was possible to pass an ICfnRuleConditionExpression via String concatenation to software.amazon.awscdk.services.certificatemanager.Certificate.Builder.domainName. With software.amazon.awscdk:aws-cdk-lib:2.234.0 & software.amazon.awscdk:cdk-asset-awscli-v1:2.2.258 it fails.
Regression Issue
- Select this option if this issue appears to be a regression.
Last Known Working CDK Library Version
2.233.0
Expected Behavior
Emits (abridged):
{
"Parameters": {
"subdomain": {
"Type": "String",
"Description": "The subdomain of the environment (e.g. 'dev', 'qa'). Leave empty/blank for no subdomain (i.e. our live environment)."
}
},
"Conditions": {
"hasSubdomain": {
"Fn::Not": [
{ "Fn::Equals": [{ "Ref": "subdomain" }, "" ] }
]
}
},
"Resources": {
"somecertDFD6D962": {
"Type": "AWS::CertificateManager::Certificate",
"Properties": {
"DomainName": {
"Fn::Join": [ "", [ "*.", { "Fn::If": [ "hasSubdomain", { "Fn::Join": [ "", [ { "Ref": "subdomain" }, "myapp.cloud" ] ] }, "myapp.cloud" ] } ] ]
},
"DomainValidationOptions": [
{
"DomainName": {
"Fn::Join": [ "", [ "*.", { "Fn::If": [ "hasSubdomain", { "Fn::Join": [ "", [ { "Ref": "subdomain" }, "myapp.cloud" ] ] }, "myapp.cloud" ] } ] ]
},
"HostedZoneId": "zoneid"
}
],
"ValidationMethod": "DNS"
}
}
}
}Current Behavior
Fails with this exception:
Exception in thread "main" software.amazon.jsii.JsiiError: Domain name must be 64 characters or less
ValidationError: Domain name must be 64 characters or less
at path [SimpleStack/somecert] in aws-cdk-lib.aws_certificatemanager.Certificate
at Kernel._Kernel_create (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:549:25)
at Kernel.create (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:219:93)
at KernelHost.processRequest (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:15482:36)
at KernelHost.run (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:15442:22)
at Immediate._onImmediate (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:15443:45)
at process.processImmediate (node:internal/timers:505:21)
at software.amazon.jsii.JsiiRuntime.processErrorResponse(JsiiRuntime.java:150)
at software.amazon.jsii.JsiiRuntime.requestResponse(JsiiRuntime.java:116)
at software.amazon.jsii.JsiiClient.createObject(JsiiClient.java:89)
at software.amazon.jsii.JsiiEngine.createNewObject(JsiiEngine.java:614)
at software.amazon.awscdk.services.certificatemanager.Certificate.<init>(Certificate.java:50)
at software.amazon.awscdk.services.certificatemanager.Certificate$Builder.build(Certificate.java:263)
at foo.SimpleStack.<init>(CertificateProblem.java:68)
at foo.CertificateProblem.main(CertificateProblem.java:23)
Reproduction Steps
Create this App & Stack combo and run the main method:
import software.amazon.awscdk.*;
import software.amazon.awscdk.services.certificatemanager.Certificate;
import software.amazon.awscdk.services.route53.IPublicHostedZone;
import software.amazon.awscdk.services.route53.PublicHostedZone;
import software.amazon.awscdk.services.route53.PublicHostedZoneAttributes;
import software.constructs.Construct;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileNotFoundException;
import java.io.FileReader;
import java.nio.file.Path;
import static software.amazon.awscdk.Fn.*;
import static software.amazon.awscdk.services.certificatemanager.CertificateValidation.fromDns;
public class CertificateProblem {
public static void main(String[] args) throws FileNotFoundException {
App app = new App();
new SimpleStack(app, "SimpleStack", StackProps.builder().build());
app.synth();
File file = Path.of(app.getOutdir(), "SimpleStack.template.json").toFile();
System.out.println(file.getAbsoluteFile());
new BufferedReader(new FileReader(file)).lines().forEach(System.out::println);
}
}
class SimpleStack extends Stack {
public SimpleStack(final Construct scope, final String id, final StackProps props) {
super(scope, id, props);
String myappDomain = "myapp.cloud";
String subdomain = CfnParameter.Builder.create(this, "subdomain")
.type("String")
.description(
"The subdomain of the environment (e.g. 'dev', 'qa'). Leave empty/blank for no " +
"subdomain (i.e. our live environment)."
)
.build()
.getValueAsString();
CfnCondition hasSubdomain = CfnCondition.Builder.create(this, "hasSubdomain")
.expression(conditionNot(conditionEquals(subdomain, "")))
.build();
ICfnRuleConditionExpression qualifiedDomain =
conditionIf(hasSubdomain.getLogicalId(), subdomain + myappDomain, myappDomain);
IPublicHostedZone zone = PublicHostedZone.fromPublicHostedZoneAttributes(
this,
"myappDomain",
PublicHostedZoneAttributes.builder()
.hostedZoneId("zoneid")
.zoneName("myappDomain")
.build()
);
Certificate.Builder.create(this, "somecert")
.domainName("*." + qualifiedDomain)
.validation(fromDns(zone))
.build();
}
}Possible Solution
No response
Additional Information/Context
No response
AWS CDK Library version (aws-cdk-lib)
2.234.0
AWS CDK CLI version
2.1100.1 (but really irrelevant)
Node.js Version
24.11.0 (but really irrelevant)
OS
macOs 26.2
Language
Java
Language Version
25
Other information
No response
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
@aws-cdk/coreRelated to core CDK functionalityRelated to core CDK functionalitybugThis issue is a bug.This issue is a bug.effort/mediumMedium work item – several days of effortMedium work item – several days of effortp0potential-regressionMarking this issue as a potential regression to be checked by team memberMarking this issue as a potential regression to be checked by team member