Skip to content

certificatemanager: Conditions in domainName are being rejected because their string representation is > 64 characters #36832

@Mahoney

Description

@Mahoney

Describe the bug

When depending on software.amazon.awscdk:aws-cdk-lib:2.233.0 & software.amazon.awscdk:cdk-asset-awscli-v1:2.2.242 it was possible to pass an ICfnRuleConditionExpression via String concatenation to software.amazon.awscdk.services.certificatemanager.Certificate.Builder.domainName. With software.amazon.awscdk:aws-cdk-lib:2.234.0 & software.amazon.awscdk:cdk-asset-awscli-v1:2.2.258 it fails.

Regression Issue

  • Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

2.233.0

Expected Behavior

Emits (abridged):

{
  "Parameters": {
    "subdomain": {
      "Type": "String",
      "Description": "The subdomain of the environment (e.g. 'dev', 'qa'). Leave empty/blank for no subdomain (i.e. our live environment)."
    }
  },
  "Conditions": {
    "hasSubdomain": {
      "Fn::Not": [
        { "Fn::Equals": [{ "Ref": "subdomain" }, "" ] }
      ]
    }
  },
  "Resources": {
    "somecertDFD6D962": {
      "Type": "AWS::CertificateManager::Certificate",
      "Properties": {
        "DomainName": {
          "Fn::Join": [ "", [ "*.", { "Fn::If": [ "hasSubdomain", { "Fn::Join": [ "", [ { "Ref": "subdomain" }, "myapp.cloud" ] ] }, "myapp.cloud" ] } ] ]
        },
        "DomainValidationOptions": [
          {
            "DomainName": {
              "Fn::Join": [ "", [ "*.", { "Fn::If": [ "hasSubdomain", { "Fn::Join": [ "", [ { "Ref": "subdomain" }, "myapp.cloud" ] ] }, "myapp.cloud" ] } ] ]
            },
            "HostedZoneId": "zoneid"
          }
        ],
        "ValidationMethod": "DNS"
      }
    }
  }
}

Current Behavior

Fails with this exception:

Exception in thread "main" software.amazon.jsii.JsiiError: Domain name must be 64 characters or less
ValidationError: Domain name must be 64 characters or less
    at path [SimpleStack/somecert] in aws-cdk-lib.aws_certificatemanager.Certificate

    at Kernel._Kernel_create (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:549:25)
    at Kernel.create (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:219:93)
    at KernelHost.processRequest (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:15482:36)
    at KernelHost.run (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:15442:22)
    at Immediate._onImmediate (/private/var/folders/7w/gfcq0bbx36qbtjxcjy3f5xwh0000gn/T/jsii-java-runtime2234619871521687440/lib/program.js:15443:45)
    at process.processImmediate (node:internal/timers:505:21)
	at software.amazon.jsii.JsiiRuntime.processErrorResponse(JsiiRuntime.java:150)
	at software.amazon.jsii.JsiiRuntime.requestResponse(JsiiRuntime.java:116)
	at software.amazon.jsii.JsiiClient.createObject(JsiiClient.java:89)
	at software.amazon.jsii.JsiiEngine.createNewObject(JsiiEngine.java:614)
	at software.amazon.awscdk.services.certificatemanager.Certificate.<init>(Certificate.java:50)
	at software.amazon.awscdk.services.certificatemanager.Certificate$Builder.build(Certificate.java:263)
	at foo.SimpleStack.<init>(CertificateProblem.java:68)
	at foo.CertificateProblem.main(CertificateProblem.java:23)

Reproduction Steps

Create this App & Stack combo and run the main method:

import software.amazon.awscdk.*;
import software.amazon.awscdk.services.certificatemanager.Certificate;
import software.amazon.awscdk.services.route53.IPublicHostedZone;
import software.amazon.awscdk.services.route53.PublicHostedZone;
import software.amazon.awscdk.services.route53.PublicHostedZoneAttributes;
import software.constructs.Construct;

import java.io.BufferedReader;
import java.io.File;
import java.io.FileNotFoundException;
import java.io.FileReader;
import java.nio.file.Path;

import static software.amazon.awscdk.Fn.*;
import static software.amazon.awscdk.services.certificatemanager.CertificateValidation.fromDns;

public class CertificateProblem {

    public static void main(String[] args) throws FileNotFoundException {
        App app = new App();

        new SimpleStack(app, "SimpleStack", StackProps.builder().build());

        app.synth();

        File file = Path.of(app.getOutdir(), "SimpleStack.template.json").toFile();
        System.out.println(file.getAbsoluteFile());
        new BufferedReader(new FileReader(file)).lines().forEach(System.out::println);
    }
}

class SimpleStack extends Stack {

    public SimpleStack(final Construct scope, final String id, final StackProps props) {
        super(scope, id, props);

        String myappDomain = "myapp.cloud";

        String subdomain = CfnParameter.Builder.create(this, "subdomain")
                .type("String")
                .description(
                        "The subdomain of the environment (e.g. 'dev', 'qa'). Leave empty/blank for no " +
                                "subdomain (i.e. our live environment)."
                        )
                .build()
                .getValueAsString();

        CfnCondition hasSubdomain = CfnCondition.Builder.create(this, "hasSubdomain")
                .expression(conditionNot(conditionEquals(subdomain, "")))
                .build();

        ICfnRuleConditionExpression qualifiedDomain =
                conditionIf(hasSubdomain.getLogicalId(), subdomain + myappDomain, myappDomain);

        IPublicHostedZone zone = PublicHostedZone.fromPublicHostedZoneAttributes(
                this,
                "myappDomain",
                PublicHostedZoneAttributes.builder()
                        .hostedZoneId("zoneid")
                        .zoneName("myappDomain")
                        .build()
                );

        Certificate.Builder.create(this, "somecert")
                .domainName("*." + qualifiedDomain)
                .validation(fromDns(zone))
                .build();
    }
}

Possible Solution

No response

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.234.0

AWS CDK CLI version

2.1100.1 (but really irrelevant)

Node.js Version

24.11.0 (but really irrelevant)

OS

macOs 26.2

Language

Java

Language Version

25

Other information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/coreRelated to core CDK functionalitybugThis issue is a bug.effort/mediumMedium work item – several days of effortp0potential-regressionMarking this issue as a potential regression to be checked by team member

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions