それぞれ異なるリージョンの CDK スタックで作成された AWS WAF Web ACL と CloudFront Distribution の紐付けができるのか試してみた

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
import * as ssm from 'aws-cdk-lib/aws-ssm';

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);

    // Web ACL の作成
    const webAcl = new wafv2.CfnWebACL(this, 'WebAcl', {
      defaultAction: { block: {} },
      scope: 'CLOUDFRONT',
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        sampledRequestsEnabled: true,
        metricName: 'WafWebAclForCloudfront',
      },
      rules: [],
    });

    // Web ACL の Arn を SSM パラメータストアに保存
    new ssm.StringParameter(this, 'WebAclArn', {
      parameterName: 'web-acl-arn',
      stringValue: webAcl.attrArn,
    });
  }
}

aws ssm get-parameter \
  --name "/web-acl-arn" \
  --region us-east-1 \
  --query 'Parameter.Value' \
  --output text
> arn:aws:wafv2:us-east-1:XXXXXXXXXXXX:global/webacl/WebAcl-KpSSk9rbWP3W/7bf29e1e-17bb-4c26-aeb6-3d6c23d5be34

import { custom_resources } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class CrossRegionGetParameter extends Construct {
  public readonly parameterValue: string;

  constructor(
    scope: Construct,
    id: string,
    props: {
      readonly parameterName: string;
      readonly region: string;
    }
  ) {
    super(scope, id);

    const getParameter = new custom_resources.AwsCustomResource(
      this,
      'GetParameterCustomResource',
      {
        onUpdate: {
          service: 'SSM',
          action: 'getParameter',
          parameters: {
            Name: props.parameterName,
          },
          physicalResourceId: custom_resources.PhysicalResourceId.of(
            props.parameterName
          ),
          region: props.region,
        },
        policy: custom_resources.AwsCustomResourcePolicy.fromSdkCalls({
          resources: custom_resources.AwsCustomResourcePolicy.ANY_RESOURCE,
        }),
        installLatestAwsSdk: false,
      }
    );

    this.parameterValue = getParameter.getResponseField('Parameter.Value');
  }
}

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';

import { CrossRegionGetParameter } from './cross-region-get-parameter-custom-resource';

export class Main2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    // SSM パラメータストアから Web ACL の Arn を取得
    const webAclArnParameter = new CrossRegionGetParameter(
      this,
      'WebAclArnParameter',
      {
        parameterName: 'web-acl-arn',
        region: 'us-east-1',
      }
    );

    // CloudFront Distribution の作成
    new cloudfront.Distribution(this, 'Distribution', {
      defaultBehavior: {
        origin: new origins.HttpOrigin('classmethod.jp'),
      },
      // Web ACL を CloudFront Distribution に紐付け
      webAclId: webAclArnParameter.parameterValue,
    });
  }
}