AwsCustomResource cannot access resources in other regions

[konstantinj]

I've tried using AwsCustomResource to publish to a sns topic in a different region. It fails with the error "Invalid parameter: TopicArn". When I try the same with awscli I get the same error.

It looks like that could be solved by letting the lambda function use the region where the sns topic is located. Unfortunately I see no way of either changing the lambda function on the fly or setting AWS_DEFAULT_REGION as environment variable to it.

It would be great if lambda could "guess" which region to use by analysing the parameters. But being able to provide the proper region would be enough for me.

Reproduction Steps

Create an sns topic in region A and give permission to be accessed by others

export class BaseStack extends cdk.Stack {
    testTopic: sns.ITopic

    constructor(app: cdk.App, id: string, props?: cdk.StackProps) {
        super(app, id, props)

        this.testTopic = new sns.Topic(this, "TestTopic", {
            topicName: "test",
            displayName: "test"
        });

        let policy = new iam.PolicyStatement()
        policy.addAnyPrincipal()
        policy.addAllResources()
        policy.addActions("sns:Publish")

        this.testTopic.addToResourcePolicy(policy)
    }
}

Create the custom resource in region B

export class TestStack extends cdk.Stack {

    constructor(app: cdk.App, id: string, props?: cdk.StackProps) {
        super(app, id, props)

        const snsPublish = new custom.AwsCustomResource(this, "SnsPublish", {
            onUpdate: {
                service: "SNS",
                action: "publish",
                parameters: {
                    Message: "Hello From another region",
                    TopicArn: "arn:aws:sns:eu-west-1:XXXXXXXXXXXX:test",
                },
                physicalResourceId: "test",
            },
        });
    }
}

Environment

• CDK CLI Version: 1.9.0 (build 30f158a)
• Module Version: 1.9.0
• OS: all
• Language: TypeScript

[SomayaB]

Hi @konstantinj, thank you for your request. It looks like @jogold is already working on it! Thank you! 👍

[eladb]

Also commented on the PR: I am not sure this is a good idea. What is the use case exactly? It's generally considered an anti-pattern to perform cross region operations. If users wish to invoke APIs in a region, they can just create a CFN stack in that region.