feat(core): per-resource cross-stack reference strength override by otaviomacedo · Pull Request #37840 · aws/aws-cdk

otaviomacedo · 2026-05-12T09:38:40Z

Allow individual resources to override the global cross-stack reference strength using CrossStackReferences.of(construct).strength(...). This enables users to selectively
weaken specific references (avoiding the deadly embrace problem) without changing
the app-wide default.

The API uses setContext() on the target construct's node, which the reference resolver
already reads. When resolving a cross-stack reference, precedence is: per-resource
context (on the producer) > global context (on the consumer) > default ('strong').

const bucket = new s3.Bucket(producer, 'SharedBucket');
CrossStackReferences.of(bucket).strength(CrossStackReferenceStrength.WEAK);

When called on an L2 construct, the context is set on its default child (the underlying
CfnResource), which is the actual target of cross-stack references.

Also updates the "Cross-stack reference strength" README section to document the
per-resource override and recommend weakening references instead of the legacy
exportValue() workaround.

Allow individual resources to override the global cross-stack reference strength via `applyCrossStackReferenceStrength()`. This enables users to selectively weaken specific references (avoiding the deadly embrace problem) without changing the app-wide default. The method is available on `Resource` and `CfnResource`, following the same pattern as `applyRemovalPolicy()`. Per-resource strength takes precedence over the global `@aws-cdk/core:defaultCrossStackReferences` context key. Also updates the "Removing automatic cross-stack references" README section to recommend weakening references instead of the legacy `exportValue()` workaround.

github-actions · 2026-05-12T09:40:26Z

⚠️ This pull request description does not follow the correct template structure.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like Closes #123 in the Issue section. If no existing issue matches your change, create one first.

aws-cdk-automation

(This review is outdated)

rix0rrr

Why methods specifically on CfnResource, and not just helpers to set the (already existing) feature flag on a construct-node level into context?

Perhaps using a CrossStackReferences.of(...) style API?

otaviomacedo · 2026-05-12T13:36:12Z

Why methods specifically on CfnResource, and not just helpers to set the (already existing) feature flag on a construct-node level into context?

Perhaps using a CrossStackReferences.of(...) style API?

Yeah, that makes more sense. Updated.

rix0rrr · 2026-05-12T14:48:30Z

+  // Per-resource strength is read from the producer via context on reference.target
+  // ("how should I be referenced?"). Global strength is read from the consumer
+  // ("how do I receive references?"). Per-resource wins when set.


Interesting choice!

This needs to be in the public documentation of the members.

Wait.

This makes it impossible to reference using one strength, but be referenced using another, doesn't it?

Should we not have 2 methods on the CrossStackReferences.of() class?

Good point. The previous iteration didn't suffer from this, but lacked an API sugar to set the strength for a given context. So perhaps we can get the best of both worlds? Something like:

CrossStackReferences.of(scope).inbound(ReferenceStrength.STRONG); // ☝️sugar for scope.applyReferenceStrength(ReferenceStrenght.STRONG) CrossStackReferences.of(scope).outbound(ReferenceStrength.WEAK); // ☝️sugar forscope.node.setContext(DEFAULT_CROSS_STACK_REFERENCES, ReferenceStrenght.WEAK)

The inbound/outbound terminology here is just a placeholder. Possible names (none of which I find self-explanatory):

For outbound:

references

receives

consumes

For inbound:

isReferencedAs

produces

Having said this, is all this sugaring worth the complexity? The main use case I see for this feature is: for safety, I want all my references to be strong, but occasionally, I need to remove a reference or a consumed resource, and I know what I'm doing, but the deadly embrace will not let me do it. So migrate only the producer with WEAK, and then do the removal, while maintaining the safety of the rest of the app.

So most of the time, on the consumer side, users will be setting the strength on a wide context, such as the whole app, or a stack. And, on the producer side, it's the opposite: users only need it for a narrow scope, such as a resource. So, just a applyReferenceStrength (open to better naming suggestion) would suffice.

I think

CrossStackReferences.of(this).produce(STRONG); CrossStackReferences.of(this).consume(WEAK);

Makes sense to me?

rix0rrr · 2026-05-12T14:58:10Z

+  }
+
+  private targetNode(): IConstruct {
+    const defaultChild = this.scope.node.defaultChild;


Why not just this.scope? What's the advantage of automatically deferring to the default child?

Because Node does not allow to set context after children have been added.

That's slightly ass. Then maybe we can't use context after all. Because for example the structure of an iam.Role looks like:

Role +-- Resource (AWS::IAM::Role) +-- Policy1 (AWS::IAM::Policy) +-- Policy2 (AWS::IAM::Policy)

And then:

CrossStackReferences.of(role).consume(some value);

Would configure the AWS::IAM::Role, where for example, which barely references anything. Instead, the Policies usually reference resources.

So while it did sound nice and regular to use the context value for everything, with the restriction of not being able to change context after the fact makes it a bad choice after all.

Sorry.

rix0rrr · 2026-05-12T14:59:20Z

+  // Per-resource strength is read from the producer via context on reference.target
+  // ("how should I be referenced?"). Global strength is read from the consumer
+  // ("how do I receive references?"). Per-resource wins when set.


Wait.

This makes it impossible to reference using one strength, but be referenced using another, doesn't it?

Should we not have 2 methods on the CrossStackReferences.of() class?

rix0rrr · 2026-05-12T15:01:24Z

+/**
+ * Controls how cross-stack references to a resource are resolved.
+ */
+export enum CrossStackReferenceStrength {


Slightly shorter?

Suggested change

export enum CrossStackReferenceStrength {

export enum ReferenceStrength {

rix0rrr · 2026-05-12T15:08:10Z

+   * Strong reference: uses CloudFormation Export/Import (same region)
+   * or ExportWriter/ExportReader custom resources (cross-region).
+   *
+   * The producing stack cannot be deleted while consumers exist.


Suggested change

* The producing stack cannot be deleted while consumers exist.

* The producing stack or resource cannot be deleted while consumers exist.

*

* If you deploy your stacks using a pipeline, you must remove the consumer first

* while keeping the producer intact, before removing the producer.

*

* Weak references make it so you can remove both producer and consumer in

* a single deployment, at the cost of a small time window of inconsistency.

The removal of a strong reference is still a missing feature. I wonder if we need something like:

Stack.of(this).consumeReference(bucket.bucketArn);

Which should lead to the given value being BOTH referenced in an inconsequential place.

Yes, the only question is: should it override the constraint imposed by the producer? In other words, for a given reference A --> B, would the precedence be:

Strength of B

Strength of -->

Strength of A

"STRONG"

or:

Strength of -->

Strength of B

Strength of A

"STRONG"

?

rix0rrr · 2026-05-12T15:08:29Z

+   *
+   * @param value - The reference strength to use.
+   */
+  public strength(value: CrossStackReferenceStrength): void {


Not super happy with the name but I don't think I have a better one for you :/

Co-authored-by: Rico Hermans <rix0rrr@gmail.com>

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

github-actions · 2026-05-13T15:14:29Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.
To suppress a specific rule, see Suppressing Rules.

	Tests	Passed ❌️	Skipped	Failed
Security Guardian Results

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2026-05-13T15:14:34Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.
To suppress a specific rule, see Suppressing Rules.

	Tests	Passed ❌️	Skipped	Failed
Security Guardian Results with resolved templates

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

otaviomacedo requested a review from a team as a code owner May 12, 2026 09:38

otaviomacedo had a problem deploying to automation May 12, 2026 09:38 — with GitHub Actions Failure

otaviomacedo temporarily deployed to automation May 12, 2026 09:38 — with GitHub Actions Inactive

github-actions Bot added the p2 label May 12, 2026

otaviomacedo temporarily deployed to automation May 12, 2026 09:38 — with GitHub Actions Inactive

mergify Bot added the contribution/core This is a PR that came from AWS. label May 12, 2026

mergify Bot temporarily deployed to automation May 12, 2026 09:39 Inactive

aws-cdk-automation previously requested changes May 12, 2026

View reviewed changes

Add untracked file

dda1c1e

otaviomacedo temporarily deployed to automation May 12, 2026 09:51 — with GitHub Actions Inactive

Fix rosetta

8e32ec7

otaviomacedo temporarily deployed to automation May 12, 2026 10:40 — with GitHub Actions Inactive

rix0rrr requested changes May 12, 2026

View reviewed changes

refactor cross-stack reference strength handling

8eec56a

otaviomacedo temporarily deployed to automation May 12, 2026 13:06 — with GitHub Actions Inactive

otaviomacedo requested a review from rix0rrr May 12, 2026 13:48

Added CrossStackReferences to the rosetta fixture imports

3b71d86

otaviomacedo temporarily deployed to automation May 12, 2026 13:53 — with GitHub Actions Inactive

otaviomacedo temporarily deployed to automation May 12, 2026 13:54 — with GitHub Actions Inactive

otaviomacedo temporarily deployed to automation May 12, 2026 13:57 — with GitHub Actions Inactive

rix0rrr reviewed May 12, 2026

View reviewed changes

Update README

79db1d9

otaviomacedo temporarily deployed to automation May 12, 2026 14:50 — with GitHub Actions Inactive

otaviomacedo temporarily deployed to automation May 12, 2026 14:54 — with GitHub Actions Inactive

rix0rrr reviewed May 12, 2026

View reviewed changes

Update packages/aws-cdk-lib/core/lib/cross-stack-reference-strength.ts

fc01c29

Co-authored-by: Rico Hermans <rix0rrr@gmail.com>

otaviomacedo temporarily deployed to automation May 13, 2026 08:35 — with GitHub Actions Inactive

otaviomacedo added 3 commits May 13, 2026 11:05

rename enum

8fac128

Merge branch 'main' into otaviom/per-scope-weak-refs

347dc77

custom reference strength overrides

0f1870c

otaviomacedo temporarily deployed to automation May 13, 2026 15:11 — with GitHub Actions Inactive

Revert to L1

cfa9562

otaviomacedo temporarily deployed to automation May 13, 2026 15:53 — with GitHub Actions Inactive

otaviomacedo temporarily deployed to automation May 13, 2026 15:54 — with GitHub Actions Inactive

	export enum CrossStackReferenceStrength {
	export enum ReferenceStrength {

-   * The producing stack cannot be deleted while consumers exist.
+   * The producing stack or resource cannot be deleted while consumers exist.
+   *
+   * If you deploy your stacks using a pipeline, you must remove the consumer first
+   * while keeping the producer intact, before removing the producer.
+   *
+   * Weak references make it so you can remove both producer and consumer in
+   * a single deployment, at the cost of a small time window of inconsistency.

Conversation

otaviomacedo commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rix0rrr left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

otaviomacedo commented May 12, 2026

Uh oh!

rix0rrr May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rix0rrr May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rix0rrr May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

otaviomacedo commented May 12, 2026 •

edited

Loading

github-actions Bot commented May 12, 2026 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

rix0rrr left a comment •

edited

Loading

rix0rrr May 12, 2026 •

edited

Loading

rix0rrr May 15, 2026 •

edited

Loading

rix0rrr May 15, 2026 •

edited

Loading

github-actions Bot commented May 13, 2026 •

edited

Loading

github-actions Bot commented May 13, 2026 •

edited

Loading