(Python) DNS validated certificate custom resource doesn't work after migrating to v2

[pcolmer]

I don't know if this is a problem with my code or jsii or CDK v2.

We've got some code that implements a custom resource to ensure that DNS validation works for ACM-issued certificates created in an AWS account different from the AWS account where Route 53 resides. The custom resource executes a Lambda that is run under the certificate account then assumes a role in order to perform the Route 53 bits.

A vastly simplified extract of the custom resource code looks like this:

import jsii
from aws_cdk.aws_certificatemanager import ICertificate
from constructs import Construct

@jsii.implements(ICertificate)
class DNSValidatedCertificateCustomResource(Construct):
    def __init__(self, scope: Construct, id: str, domain_name: str, hosted_zone_id: str, subject_alternative_names: list, role: str=None) -> None:
        super().__init__(scope, id)

I've omitted some of the imports and the bulk of the code because I think the problem is in the initialisation of the function.

When I call diff to see if migrating to v2 is going to change anything, I get this error and stacktrace:

jsii.errors.JavaScriptError:
  Error: Expected a string, got {"$jsii.byref":"aws-cdk-lib.Reference@10068"}
      at Object.deserialize (/tmp/tmpzq6hsh68/lib/program.js:9157:31)
      at Kernel._toSandbox (/tmp/tmpzq6hsh68/lib/program.js:8771:69)
      at Construct.get [as certificateArn] (/tmp/tmpzq6hsh68/lib/program.js:8502:37)
      at Function.fromAcmCertificate (/tmp/jsii-kernel-c7BETb/node_modules/aws-cdk-lib/aws-cloudfront/lib/web-distribution.js:1:2695)
      at /tmp/tmpzq6hsh68/lib/program.js:8257:114
      at Kernel._wrapSandboxCode (/tmp/tmpzq6hsh68/lib/program.js:8848:24)
      at /tmp/tmpzq6hsh68/lib/program.js:8257:87
      at Kernel._ensureSync (/tmp/tmpzq6hsh68/lib/program.js:8829:28)
      at Kernel.sinvoke (/tmp/tmpzq6hsh68/lib/program.js:8257:34)
      at KernelHost.processRequest (/tmp/tmpzq6hsh68/lib/program.js:9769:36)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "www_lavasoftware_org.py", line 14, in <module>
    shared.core.build_stack()
  File "/home/philip/git/cdk-static-websites/shared/core.py", line 56, in build_stack
    website_stack = CreateWebsiteStack(app, f'{hyphenated_name}-website-stack',
  File "/home/philip/.local/share/virtualenvs/cdk-static-websites-zOm9C-Wd/lib/python3.8/site-packages/jsii/_runtime.py", line 86, in __call__
    inst = super().__call__(*args, **kwargs)
  File "/home/philip/git/cdk-static-websites/stacks/create_website.py", line 125, in __init__
    cert_config = cloudfront.ViewerCertificate.from_acm_certificate(
  File "/home/philip/.local/share/virtualenvs/cdk-static-websites-zOm9C-Wd/lib/python3.8/site-packages/aws_cdk/aws_cloudfront/__init__.py", line 17501, in from_acm_certificate
    return typing.cast("ViewerCertificate", jsii.sinvoke(cls, "fromAcmCertificate", [certificate, options]))
  File "/home/philip/.local/share/virtualenvs/cdk-static-websites-zOm9C-Wd/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 143, in wrapped
    return _recursize_dereference(kernel, fn(kernel, *args, **kwargs))
  File "/home/philip/.local/share/virtualenvs/cdk-static-websites-zOm9C-Wd/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 382, in sinvoke
    return _callback_till_result(self, response, InvokeResponse)
  File "/home/philip/.local/share/virtualenvs/cdk-static-websites-zOm9C-Wd/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 235, in _callback_till_result
    response = kernel.sync_complete(response.cbid, None, result, response_type)
  File "/home/philip/.local/share/virtualenvs/cdk-static-websites-zOm9C-Wd/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 401, in sync_complete
    return self.provider.sync_complete(
  File "/home/philip/.local/share/virtualenvs/cdk-static-websites-zOm9C-Wd/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 382, in sync_complete
    resp = self._process.send(_CompleteRequest(complete=request), response_type)
  File "/home/philip/.local/share/virtualenvs/cdk-static-websites-zOm9C-Wd/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 326, in send
    raise JSIIError(resp.error) from JavaScriptError(resp.stack)
jsii.errors.JSIIError: Expected a string, got {"$jsii.byref":"aws-cdk-lib.Reference@10068"}

Line 56 of build_stack is this:

    website_stack = CreateWebsiteStack(app, f'{hyphenated_name}-website-stack',
        env=stack_env, domain=SITE_DOMAIN, subdomain=SITE_SUBDOMAIN, hosted_zone_id=DNS_ZONE_ID,
        sans=SITE_SANS, role=ARN_R53_ASSUME_ROLE,
        security_headers_arn=common_stack.add_security_headers_arn,
        index_to_dirs_arn=common_stack.add_index_to_directory_arn
    )

and CreateWebsiteStack sets up the certificate with this call:

        certificate = DNSValidatedCertificateCustomResource(
            self,
            fqdn,
            domain_name=fqdn,
            hosted_zone_id=hosted_zone_id,
            subject_alternative_names=sans,
            role=role
        )

I don't know how to proceed in order to get my code working again so any help provided would be very much appreciated.

jsii is version 1.59.0, aws-cdk-lib is version 2.27.0

[pcolmer]

I've found the problem - it was my code. The end of the __init__ code for DNSValidatedCertificateCustomResource had this line:

self.arn = certificate.get_att("Arn")

so that:

    @property
    def certificate_arn(self):
        # Expose/return the certificate Arn value as a property on this interface.
        return self.arn

worked. However, get_att needed to be get_att_string instead. Not quite sure why it worked previously but hey ho!

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.