Update my AWS Hosted Zone

[yash-sharma01]

I'm trying to move my saas-boilerplate to a different domain, already updated all the environment variables and other configs, but on running pnpm saas infra deploy
I'm receiving this error:
Export app-stage-cfCertificateArn cannot be updated as it is in use by app-stage-ComponentsStack and app-stage-WebAppStack

Referring to an AWS Knowledge Center discussion (Link):
In your AWS CloudFormation template, replace intrinsic functions with the imported values for every stack that references the exported output value of your stack.
For example, the intrinsic functions Fn::ImportValue and !ImportValue are both replaced with the imported value arn:aws:s3:::sample in the following JSON and YAML templates.

Using this sounds like a hack, should I go with this? or is there a better and more structured approach for the same.

[pziemkowski]

Usually when I have this problem I resolve it in three stages:

1. Create the new certificate as a new resource without deleting the old one.

   • Add the CDK code for new certificate next to the old one. Keep the old one unchanged!
     You have to use a different resource ID, and different export name. Probably a good idea would be to just add a v2 suffix to both.
   • deploy the stack with new certificate

2. Use new certificate in Components stack (Use the new exported value)

3. Remove the old certificate from CDK and redeploy the certificate stack for cleanup.

Hope it helps!

[pziemkowski]

Something like this:

(there could be some errors, as I wrote this code directly in github comment):

export function getCloudFrontCertificateArnOutputExportName(envSettings: EnvironmentSettings) {
  return `${envSettings.projectEnvName}-cfCertificateArn`;
}

export function getCloudfrontCertificateArn(envSettings: EnvironmentSettings) {
  return envSettings.hostedZone.id
    ? Fn.importValue(getCloudFrontCertificateArnOutputExportName(envSettings))
    : envSettings.certificates.cloudfrontCertificateArn;
}

export function getCloudFrontCertificateV2ArnOutputExportName(envSettings: EnvironmentSettings) {
  return `${envSettings.projectEnvName}-cfCertificateArn`;
}

export function getCloudfrontCertificateV2Arn(envSettings: EnvironmentSettings) {
  return envSettings.hostedZone.id
    ? Fn.importValue(getCloudFrontCertificateV2ArnOutputExportName(envSettings))
    : envSettings.certificates.cloudfrontCertificateArn;
}

WebAppStack:

export class WebAppStack extends Stack {
  webAppCloudFrontDistribution?: WebAppCloudFrontDistribution;

  constructor(scope: App, id: string, props: WebAppStackProps) {
    super(scope, id, props);

    const domainZone = getHostedZone(this, props.envSettings);
    const certificateArn = getCloudfrontCertificateV2Arn(props.envSettings);

    const filesPath = `${__dirname}/../../../build`;
    if (fs.existsSync(filesPath)) {
      this.webAppCloudFrontDistribution = new WebAppCloudFrontDistribution(this, 'WebApp', {
        sources: [s3Deployment.Source.asset(filesPath)],
        domainZone,
        domainName: props.envSettings.domains.webApp,
        apiDomainName: props.envSettings.domains.api,
        certificateArn,
        authLambdaSSMParameterName: UsEastResourcesStack.getAuthLambdaVersionArnSSMParameterName(props.envSettings),
        basicAuth: props.envSettings.appBasicAuth,
        envSettings: props.envSettings,
      });
    }
  }
}

mainCertificates.ts:

export class MainCertificates extends Construct {
  certificate?: certManager.Certificate;
  cloudFrontCertificate?: certManager.DnsValidatedCertificate;

  static geCertificateArnOutputExportName(envSettings: EnvironmentSettings) {
    return `${envSettings.projectEnvName}-certificateArn`;
  }

  constructor(scope: Construct, id: string, props: EnvConstructProps) {
    super(scope, id);

    const hostedZone = getHostedZone(this, props.envSettings);
    const domainName = this.getDomainName(props);
    
    const hostedZoneV2 = getHostedZoneV2(this, props.envSettings);
    const domainNameV2 = this.getDomainNameV2(props);

    if (hostedZone) {
      this.certificate = new certManager.Certificate(this, 'AppsCertificate', {
        domainName,
        subjectAlternativeNames: [`*.${domainName}`],
        validation: certManager.CertificateValidation.fromDns(hostedZone),
      });

      // todo: Use Certificate here when figure it our how to pass region prop to it (currently it's not available)
      this.cloudFrontCertificate = new certManager.DnsValidatedCertificate(
        this,
        'CloudFrontCertificate',
        {
          region: 'us-east-1',
          domainName,
          subjectAlternativeNames: [`*.${domainName}`],
          hostedZone,
        }
      );
      
      this.cloudFrontCertificateV2 = new certManager.DnsValidatedCertificate(
        this,
        'CloudFrontCertificateV2',
        {
          region: 'us-east-1',
          domainName: domainNameV2,
          subjectAlternativeNames: [`*.${domainNameV2}`],
          hostedZone: hostedZoneV2,
        }
      );

      new CfnOutput(this, 'AppCertificateArnOutput', {
        value: this.certificate.certificateArn,
        exportName: MainCertificates.geCertificateArnOutputExportName(
          props.envSettings
        ),
      });

      new CfnOutput(this, 'CloudFrontCertificateArnOutput', {
        value: this.cloudFrontCertificate.certificateArn,
        exportName: getCloudFrontCertificateArnOutputExportName(
          props.envSettings
        ),
      });
      
      new CfnOutput(this, 'CloudFrontCertificateV2ArnOutput', {
        value: this.cloudFrontCertificateV2.certificateArn,
        exportName: getCloudFrontCertificateV2ArnOutputExportName(
          props.envSettings
        ),
      });
    }
  }

  private getDomainName(props: EnvConstructProps) {
    const domainName = props.envSettings.certificates.domain;
    if (!domainName) {
      return `${props.envSettings.envStage}.${props.envSettings.hostedZone.name}`;
    }
    return domainName;
  }
}

you probably also need to have another getHostedZone function with your new hosted zone for this new domain.

[yash-sharma01]

Thanks for the reply!
I did try your suggested solution, but unfortunately, the output is the same.

[yash-sharma01]

Is there a way to delete the complete setup and execute a fresh deployment?

[pziemkowski]

yeah, just delete stacks from AWS console starting with the one you deployed last

[yash-sharma01]

Yeah, it worked, thanks for the reply!