# help

Dan Van Brunt

12/01/2021, 10:58 PM
How does
work behinds the scenes? It seems to prevent any future changes to thingy using L2 methods?
We have the following code …
Copy code
const cfDistribution = this.cfDistribution.node.defaultChild as cf.CfnDistribution
    const config = stack.resolve(cfDistribution.distributionConfig)

    const origins = cf.OriginProps) =>
      origin?.originPath === `/${this.deployId}`
        ? {
            originCustomHeaders: [
                headerName: 'X-Site-Root-Key',
                headerValue: this.deployId,
        : origin,

    cfDistribution.distributionConfig = {
      webAclId: settings.WAF,
and I tried to run this code on the next line and it fails….
Copy code
if (props.httpApi) {
      const { httpApi } = props
      const apiDomain = `${httpApi.httpApiId}.execute-api.${region}.<|>`
      this.cfDistribution.addBehavior('/api', new cfOrigins.HttpOrigin(apiDomain), {
        allowedMethods: cf.AllowedMethods.ALLOW_ALL,
        viewerProtocolPolicy: cf.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        cachePolicy: cf.CachePolicy.CACHING_DISABLED,
        compress: false,
saying that an origin is missing. What seems to have happened is the behavior is added that references an origin that doesn’t exist, since the
seems to have sealed any edits to that cfDistribution.
Changing the order fixed the issue in our case BUT, this seems to speak to a larger risk with using it as a construct author. IF you build a construct that uses
it then prevents you from exposing that underlining thing. Eg.
wouldn’t work if StaticSite internally resolved ``cfDistribution`` . Is any of this correct? How else can we accomplish our above code is not to resolve?


12/01/2021, 11:51 PM
Hey @Dan Van Brunt, haven’t used it.. it seems CDK does a best try to resolve any token values?
Looking at the test, it seems obviously there are tokens that cannot be resolved at build time
See this test, if region is specific,
would know how many zones there are in the region. But if region is not known at build time,
won’t be able to resolve it.

Dan Van Brunt

12/01/2021, 11:54 PM
I don’t think “build time” vs “deploy time” is our issue though.
I can get the details we need from resolve. But it seems to lock the resource after running it.
In order for us to filter the origins in our construct to find the one that contains the deployId… I first need to resolve. (I think) which locks that resource so that when I try to add a behavior after the resolve It does not work.