(pipelines): "cannot consume a cross reference from stack" when using CDK Pipelines

Deploying a subclass of Stage with CdkPipeline to a different region fails because of cdk synth error.

Reproduction Steps

#!/usr/bin/env node
import 'source-map-support/register';

import { App, Construct, Stage, Stack, StackProps, StageProps, SecretValue } from '@aws-cdk/core';
import { CdkPipeline, SimpleSynthAction } from '@aws-cdk/pipelines';
import * as codepipeline from '@aws-cdk/aws-codepipeline';
import * as codepipeline_actions from '@aws-cdk/aws-codepipeline-actions';
import * as dynamodb from '@aws-cdk/aws-dynamodb';

class DatabaseStack extends Stack {
  constructor(scope: Construct, id: string, props?: StageProps) {
    super(scope, id, props);

    new dynamodb.Table(this, 'Table', {
      partitionKey: { name: 'PK', type: dynamodb.AttributeType.STRING },
    });
  }
}

class MyApplication extends Stage {
  constructor(scope: Construct, id: string, props?: StageProps) {
    super(scope, id, props);

    new DatabaseStack(this, 'Database');
  }
}

class AwsCdkPipelinesCrossRegionStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const sourceArtifact = new codepipeline.Artifact();
    const cloudAssemblyArtifact = new codepipeline.Artifact();

    const pipeline = new CdkPipeline(this, 'Pipeline', {
      pipelineName: 'MyAppPipeline',
      cloudAssemblyArtifact,

      sourceAction: new codepipeline_actions.GitHubSourceAction({
        actionName: 'GitHub',
        output: sourceArtifact,
        oauthToken: SecretValue.secretsManager('GITHUB_TOKEN_NAME'),
        owner: 'OWNER',
        repo: 'REPO',
      }),

      synthAction: SimpleSynthAction.standardNpmSynth({
        sourceArtifact,
        cloudAssemblyArtifact,
      }),
    });

    pipeline.addApplicationStage(new MyApplication(this, 'Prod', {
      // stage env
      env: {
        account: '111111111111',
        region: 'eu-west-1',
      },
    }));
  }
}

const app = new App();
new AwsCdkPipelinesCrossRegionStack(app, 'AwsCdkPipelinesCrossRegionStack', {
  // pipeline env
  env: {
    account: '111111111111',
    region: 'us-east-1',
  },
});

$ npm run cdk synth

> aws-cdk-pipelines-cross-region@0.1.0 cdk /workspaces/aws-cdk-pipelines-cross-region
> cdk "synth"


/workspaces/aws-cdk-pipelines-cross-region/node_modules/@aws-cdk/core/lib/private/refs.ts:57
    throw new Error(
          ^
Error: Stack "AwsCdkPipelinesCrossRegionStack" cannot consume a cross reference from stack "cross-region-stack-111111111111:eu-west-1". Cross stack references are only supported for stacks deployed to the same environment or between nested stacks and their parent stack
    at resolveValue (/workspaces/aws-cdk-pipelines-cross-region/node_modules/@aws-cdk/core/lib/private/refs.ts:57:11)
    at Object.resolveReferences (/workspaces/aws-cdk-pipelines-cross-region/node_modules/@aws-cdk/core/lib/private/refs.ts:33:24)
    at Object.prepareApp (/workspaces/aws-cdk-pipelines-cross-region/node_modules/@aws-cdk/core/lib/private/prepare-app.ts:31:3)
    at Object.synthesize (/workspaces/aws-cdk-pipelines-cross-region/node_modules/@aws-cdk/core/lib/private/synthesis.ts:24:3)
    at App.synth (/workspaces/aws-cdk-pipelines-cross-region/node_modules/@aws-cdk/core/lib/stage.ts:188:23)
    at process.<anonymous> (/workspaces/aws-cdk-pipelines-cross-region/node_modules/@aws-cdk/core/lib/app.ts:123:45)
    at Object.onceWrapper (events.js:422:26)
    at process.emit (events.js:315:20)
    at process.EventEmitter.emit (domain.js:467:12)
    at process.emit (/workspaces/aws-cdk-pipelines-cross-region/node_modules/source-map-support/source-map-support.js:495:21)

What did you expect to happen?

Generating a template succeeded.

What actually happened?

pipeline env	stage env	result
111111111111, us-east-1	111111111111, us-east-1	Successfully synthesized to /workspaces/aws-cdk-pipelines-cross-region/cdk.out
111111111111, us-east-1	222222222222, us-east-1	Successfully synthesized to /workspaces/aws-cdk-pipelines-cross-region/cdk.out
111111111111, us-east-1	111111111111, eu-west-1	Error: Stack “AwsCdkPipelinesCrossRegionStack” cannot consume a cross reference from stack “cross-region-stack-111111111111:eu-west-1”
111111111111, us-east-1	222222222222, eu-west-1	Error: Stack “AwsCdkPipelinesCrossRegionStack” cannot consume a cross reference from stack “cross-region-stack-111111111111:eu-west-1”

Environment

• CDK CLI Version : v1.87.0
• Framework Version: v1.87.0
• Node.js Version: v14.15.4
• OS : Debian GNU/Linux 10 (buster)
• Language (Version): TypeScript (3.9.7)

Other

cdk version	result
v1.76	Successfully synthesized to /workspaces/aws-cdk-pipelines-cross-region/cdk.out
v1.77	Successfully synthesized to /workspaces/aws-cdk-pipelines-cross-region/cdk.out
v1.78 ~	Error: Stack “AwsCdkPipelinesCrossRegionStack” cannot consume a cross reference from stack “cross-region-stack-111111111111:eu-west-1”

---

This is 🐛 Bug Report

[rix0rrr]

Ha haaaah! Found the culprit!

    "@aws-cdk/aws-kms:defaultKeyPolicies": true,

Removing that makes it work.

Thanks for the repro @tompiscitell, that was extremely helpful. Still not quite sure why the error didn’t repro for me, but now we have a way to investigate.

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.