[aws-elasticsearch] Can't reference existing ES domain from imported values

I’m trying to import ES domain from Output values available in another CloudFormation Stack. I’m hitting jsii.errors.JSIIError: Invalid URL: ${Token[TOKEN.172]}. When I’m using extracted values directly importing ES works fine. Also note, that similar code works fine in different conditions - eg reference imported securityGroup

Reproduction Steps

        es = elasticsearch.Domain.from_domain_attributes(
            self, "ESDomain",
            domain_endpoint=core.Fn.import_value(
                    shared_value_to_import=es_domain_name + "-ElasticSearchSecurityGroupId"
                ),
            domain_arn=core.Fn.import_value(
                    shared_value_to_import=es_domain_name + "-ElasticSearchSecurityGroupId"
                )
        )

What did you expect to happen?

Import ES domain object from Outputs of another stack.

What actually happened?

**jsii.errors.JavaScriptError: 
  TypeError [ERR_INVALID_URL]: Invalid URL: ${Token[TOKEN.172]}**
     

Environment

• CLI Version :1.67.0 (build 2b4dd71)
• Framework Version: 1.67.0 (build 2b4dd71)
• Node.js Version: v12.18.3
• OS : Mac OS Catalina
• Language (Version):vPython 3.8.5

Other

stackTrace:

jsii.errors.JavaScriptError: 
>   TypeError [ERR_INVALID_URL]: Invalid URL: ${Token[TOKEN.172]}
>       at onParseError (internal/url.js:256:9)
>       at new URL (internal/url.js:332:5)
>       at extractNameFromEndpoint (/private/var/folders/98/byg4ch215m58rf7vs2957w3m0000gn/T/jsii-kernel-BTnvjr/node_modules/@aws-cdk/aws-elasticsearch/lib/domain.js:711:26)
>       at Function.fromDomainAttributes (/private/var/folders/98/byg4ch215m58rf7vs2957w3m0000gn/T/jsii-kernel-BTnvjr/node_modules/@aws-cdk/aws-elasticsearch/lib/domain.js:684:28)
>       at ./cdk/.env/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7780:51
>       at Kernel._wrapSandboxCode (./cdk/.env/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:8422:19)
>       at ./cdk/.env/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7780:25
>       at Kernel._ensureSync (/Users/szym/bizgle/devops/cdk/.env/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:8395:20)
>       at Kernel.sinvoke (./cdk/.env/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7779:26)
>       at KernelHost.processRequest (./cdk/.env/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7458:28)
>       at KernelHost.run (./cdk/.env/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7396:14)
>       at Immediate._onImmediate (./cdk/.env/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7399:37)
>       at processImmediate (internal/timers.js:456:21)
> 
> The above exception was the direct cause of the following exception:
> 
> Traceback (most recent call last):
>   File "app.py", line 13, in <module>
>     CoreStack(
>   File "./cdk/.env/lib/python3.8/site-packages/jsii/_runtime.py", line 69, in __call__
>     inst = super().__call__(*args, **kwargs)
>   File "./cdk/server/infrastructure.py", line 29, in __init__
>     log_group = CloudWatchLogs(self, "CloudWatchLogs",
>   File "./cdk/.env/lib/python3.8/site-packages/jsii/_runtime.py", line 69, in __call__
>     inst = super().__call__(*args, **kwargs)
>   File "./devops/cdk/server/cloudwatch_logs.py", line 14, in __init__
>     es = elasticsearch.Domain.from_domain_attributes(
>   File "./cdk/.env/lib/python3.8/site-packages/aws_cdk/aws_elasticsearch/__init__.py", line 4796, in from_domain_attributes
>     return jsii.sinvoke(cls, "fromDomainAttributes", [scope, id, attrs])
>   File "./cdk/.env/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 125, in wrapped
>     return _recursize_dereference(kernel, fn(kernel, *args, **kwargs))
>   File "./cdk/.env/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 334, in sinvoke
>     response = self.provider.sinvoke(
>   File "./devops/cdk/.env/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 354, in sinvoke
>     return self._process.send(request, InvokeResponse)
>   File "./cdk/.env/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 321, in send
>     raise JSIIError(resp.error) from JavaScriptError(resp.stack)
> jsii.errors.JSIIError: Invalid URL: ${Token[TOKEN.172]}
> Subprocess exited with error 1

---

This is 🐛 Bug Report

[smmnloes]

+1 In the current state it is not possible to have a stack containing an ES-Domain be accessed by other stacks via exports, unless the stacks are deployed together (which in our case they are not, they live in different repos). This would be a really useful feature if tokens would work.

[hoganbc]

My team has a use case to import the Domain so that a Lambda can be granted to it and the url passed via Lambda environment variables. These permissions are rendered on the Lambda’s IAM Role. We have several of these lambda stacks and one stack defining the Domain. They are deployed independently.