aws-certificatemanager: Support construct to create Certificate from any region, similar to EdgeFunction

[Xarno]

Describe the feature

As requested and liked many times please have the Certificate Construct accept a region setting again, as it has had in DnsValidatedCertificate.
#9274 (comment)

Use Case

Create Cloudfront distributions in one region, create the corresponding certificate in us-east-1.
Create Cognito Userpools with a custom certificate as mostafafarzaneh mentioned in the linked issue.

Proposed Solution

No response

Other Information

Also the current documentation is wrong.
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_certificatemanager.Certificate.html#validation mentions a „region“ property which does not exist in https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_certificatemanager.CertificateValidation.html or https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_certificatemanager.CertificationValidationProps.html

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.76.0

Environment details (OS name and version, etc.)

Mac OS 13.3

[peterwoodworth]

This is how we recommend doing it now https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_certificatemanager-readme.html#cross-region-certificates. If this doesn't work then let us know

[alejandro-gstack]

@peterwoodworth, The way that AWS is proposing managing the certificate in a different stack is not providing a good developer experience because instead of defining in the same CDK stack, we will need to create two stacks, one for creating the ACM certificate in the us-east-1 region that requests for example Cloudfront and then reference it in the other stack built in the desired region.

[peterwoodworth]

I'm curious what the negative experience is exactly with needing to declare another stack in your app, is there a use case where this isn't trivial?

[alejandro-gstack]

Hi @peterwoodworth, consider that you are creating templates (constructs in CDK) to reduce the complexity of deploying infrastructure like a static website (s3/cloudfront/route53/certificate). With the previous approach, developers will create a CDK stack and declare the template and the resources needed in one stack.

Now, they will need to manage two stacks and one stack that only will contain a certificate, and they will need to deploy them in a specific order.

Do you know what would be the suitable infra definition to encapsulate the creation of the certificate in (us-east-1) and all the other resources in a different region? Can I attach the two CDK stacks and programmatically define the order in which they will be deployed?

Checking the documentation, we will need to deploy the CDK stacks separately and in a particular order.

import { aws_cloudfront as cloudfront, aws_cloudfront_origins as origins } from 'aws-cdk-lib';
declare const app: App;

const stack1 = new Stack(app, 'Stack1', {
  env: {
    region: 'us-east-1',
  },
  crossRegionReferences: true,
});
const cert = new acm.Certificate(stack1, 'Cert', {
  domainName: '*.example.com',
  validation: acm.CertificateValidation.fromDns(PublicHostedZone.fromHostedZoneId(stack1, 'Zone', 'ZONE_ID')),
});

const stack2 = new Stack(app, 'Stack2', {
  env: {
    region: 'us-east-2',
  },
  crossRegionReferences: true,
});

new cloudfront.Distribution(stack2, 'Distribution', {
  defaultBehavior: {
    origin: new origins.HttpOrigin('example.com'),
  },
  domainNames: ['dev.example.com'],
  certificate: cert,
});