fix(core): allow override with cross-stack references (#24920)

closes #18882

The problem is described in the original issue, and below is what I found as the root cause and how it can be fixed.

---

Previously when we used a cross-stack reference in override, it was not resolved as an `Fn::ImportValue`.

To make it an `Fn::ImportValue`, we need to get every token in an app and find _references_ (tokens that references resources outside of its stack) from them. The related code is here:

https://github.com/aws/aws-cdk/blob/810d736a8d20638e778c5773507f0edb12733a49/packages/%40aws-cdk/core/lib/private/refs.ts#L139-L140

To get all the tokens in an app, we use `RememberingTokenResolver`, which _remembers_ every token it has found during resolution. So basically this resolver must be used on every resolution to find all the tokens.

https://github.com/aws/aws-cdk/blob/810d736a8d20638e778c5773507f0edb12733a49/packages/%40aws-cdk/core/lib/private/resolve.ts#L270-L276

However, the resolver is not used specifically when we resolve tokens in **raw overrides**. Actually the current interface of `postProcess` function of `PostResolveToken` class makes It difficult to use an external resolver.

https://github.com/aws/aws-cdk/blob/810d736a8d20638e778c5773507f0edb12733a49/packages/%40aws-cdk/core/lib/cfn-resource.ts#L374-L380

That is why, in this PR, we move the resolution process outside of the `postProcess`, allowing to resolve tokens in raw overrides with the `RememberingTokenResolver` resolver.

This change also simplifies the current implementation of deepMerge as a side product.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: tmokmss

packages/aws-cdk-lib/core/lib/cfn-resource.ts

@@ -7,11 +7,9 @@ import { CfnCreationPolicy, CfnDeletionPolicy, CfnUpdatePolicy } from './cfn-res
 import { Construct, IConstruct, Node } from 'constructs';
 import { addDependency, obtainDependencies, removeDependency } from './deps';
 import { CfnReference } from './private/cfn-reference';
-import { CLOUDFORMATION_TOKEN_RESOLVER } from './private/cloudformation-lang';
 import { Reference } from './reference';
 import { RemovalPolicy, RemovalPolicyOptions } from './removal-policy';
 import { TagManager } from './tag-manager';
-import { Tokenization } from './token';
 import { capitalizePropertyNames, ignoreEmpty, PostResolveToken } from './util';
 import { FeatureFlags } from './feature-flags';
 import { ResolutionTypeHint } from './type-hints';
@@ -432,15 +430,13 @@ export class CfnResource extends CfnRefElement {
             Description: this.cfnOptions.description,
             Metadata: ignoreEmpty(this.cfnOptions.metadata),
             Condition: this.cfnOptions.condition && this.cfnOptions.condition.logicalId,
-          }, resourceDef => {
+          }, (resourceDef, context) => {
             const renderedProps = this.renderProperties(resourceDef.Properties || {});
             if (renderedProps) {
               const hasDefined = Object.values(renderedProps).find(v => v !== undefined);
               resourceDef.Properties = hasDefined !== undefined ? renderedProps : undefined;
             }
-            const resolvedRawOverrides = Tokenization.resolve(this.rawOverrides, {
-              scope: this,
-              resolver: CLOUDFORMATION_TOKEN_RESOLVER,
+            const resolvedRawOverrides = context.resolve(this.rawOverrides, {
               // we need to preserve the empty elements here,
               // as that's how removing overrides are represented as
               removeEmpty: false,

packages/aws-cdk-lib/core/lib/resolvable.ts

@@ -44,6 +44,13 @@ export interface ResolveChangeContextOptions {
    * @default - Unchanged
    */
   readonly allowIntrinsicKeys?: boolean;
+
+  /**
+   * Whether to remove undefined elements from arrays and objects when resolving.
+   *
+   * @default - Unchanged
+   */
+  readonly removeEmpty?: boolean;
 }
 
 /**

packages/aws-cdk-lib/core/lib/util.ts

@@ -79,7 +79,7 @@ export function filterUndefined(obj: any): any {
  * A Token that applies a function AFTER resolve resolution
  */
 export class PostResolveToken extends Intrinsic implements IPostProcessor {
-  constructor(value: any, private readonly processor: (x: any) => any) {
+  constructor(value: any, private readonly processor: (x: any, context: IResolveContext) => any) {
     super(value, { stackTrace: false });
   }
 
@@ -88,8 +88,8 @@ export class PostResolveToken extends Intrinsic implements IPostProcessor {
     return super.resolve(context);
   }
 
-  public postProcess(o: any, _context: IResolveContext): any {
-    return this.processor(o);
+  public postProcess(o: any, context: IResolveContext): any {
+    return this.processor(o, context);
   }
 }
 

packages/aws-cdk-lib/core/test/resource.test.ts

@@ -821,6 +821,36 @@ describe('resource', () => {
       });
     });
 
+    test('overrides allow cross-stack references', () => {
+      // GIVEN
+      const app = new App();
+      const stack1 = new Stack(app, 'Stack1');
+      const stack2 = new Stack(app, 'Stack2');
+      const res1 = new CfnResource(stack1, 'SomeResource1', {
+        type: 'Some::Resource1',
+      });
+      const res2 = new CfnResource(stack2, 'SomeResource2', {
+        type: 'Some::Resource2',
+      });
+
+      // WHEN
+      res2.addPropertyOverride('Key', res1.getAtt('Value'));
+
+      // THEN
+      expect(
+        app.synth().getStackByName(stack2.stackName).template?.Resources,
+      ).toEqual({
+        SomeResource2: {
+          Properties: {
+            Key: {
+              'Fn::ImportValue': 'Stack1:ExportsOutputFnGetAttSomeResource1Value50DD3EF0',
+            },
+          },
+          Type: 'Some::Resource2',
+        },
+      });
+    });
+
     describe('using mutable properties', () => {
       test('can be used by derived classes to specify overrides before render()', () => {
         const stack = new Stack();

packages/aws-cdk-lib/core/test/stack.test.ts

@@ -1498,7 +1498,7 @@ describe('stack', () => {
       public _toCloudFormation() {
         return new PostResolveToken({
           xoo: 1234,
-        }, props => {
+        }, (props, _context) => {
           validateString(props).assertSuccess();
         });
       }