fix(cli): clear error for intrinsic certificateArn in domain commands

doc/custom-domain.md

@@ -51,6 +51,8 @@ For example, if you want to use blue/green deployments, you might need to associ
 
 For more information about managing domains with the CLI, see the [Commands](commands.md#domain) section.
 
+⚠️ The CLI commands resolve values themselves rather than through CloudFormation, so `certificateArn` must be a literal ARN string when using them. CloudFormation intrinsic functions (e.g. `Fn::ImportValue`) are only resolved when the domain is managed by CloudFormation (`useCloudFormation: true`).
+
 ## Ejecting from CloudFormation
 
 If you started to manage your domain through CloudFormation and want to eject from it, follow the following steps:

src/__tests__/commands.test.ts

@@ -85,7 +85,7 @@
 
     expect(createCall).toBeDefined();
     expect(listCertCall).toBeUndefined();
     expect(createCall![0].input).toMatchInlineSnapshot(`
       {
         "certificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/8acd9c69-1704-462c-be91-b5d7ce45c493",
         "domainName": "api.example.com",
@@ -93,6 +93,32 @@
     `);
   });
 
+  it('should reject an intrinsic-function certificateArn (CLI cannot resolve it)', async () => {
+    mockSend.mockResolvedValue({});
+
+    await expect(
+      runServerless({
+        fixture: 'appsync',
+        command: 'appsync domain create',
+        configExt: {
+          appSync: {
+            domain: {
+              useCloudFormation: false,
+              certificateArn: { 'Fn::ImportValue': 'exportedCertArn' },
+            },
+          },
+        },
+      }),
+    ).rejects.toThrow(
+      /the `appsync domain` CLI commands require a plain ARN string/,
+    );
+
+    const createCall = mockSend.mock.calls.find(
+      ([cmd]) => cmd instanceof CreateDomainNameCommand,
+    );
+    expect(createCall).toBeUndefined();
+  });
+
   it('should create a domain and find a matching certificate, exact match', async () => {
     mockSend.mockImplementation((cmd) => {
       if (cmd instanceof ListCertificatesCommand) {
@@ -147,7 +173,7 @@
       }
     `);
     expect(createCall).toBeDefined();
     expect(createCall![0].input).toMatchInlineSnapshot(`
       {
         "certificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/8acd9c69-1704-462c-be91-b5d7ce45c493",
         "domainName": "api.example.com",
@@ -254,7 +280,7 @@
       }
     `);
     expect(createCall).toBeDefined();
     expect(createCall![0].input).toMatchInlineSnapshot(`
       {
         "certificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/fd8f67f7-bf19-4894-80db-0c49bf5dd507",
         "domainName": "api.example.com",
@@ -284,7 +310,7 @@
       ([cmd]) => cmd instanceof DeleteDomainNameCommand,
     );
     expect(deleteCall).toBeDefined();
     expect(deleteCall![0].input).toMatchInlineSnapshot(`
       {
         "domainName": "api.example.com",
       }
@@ -316,7 +342,7 @@
       ([cmd]) => cmd instanceof DeleteDomainNameCommand,
     );
     expect(deleteCall).toBeDefined();
     expect(deleteCall![0].input).toMatchInlineSnapshot(`
       {
         "domainName": "api.example.com",
       }
@@ -396,7 +422,7 @@
         },
       ]
     `);
     expect(associateCall![0].input).toMatchInlineSnapshot(`
       {
         "apiId": "123456789",
         "domainName": "api.example.com",
@@ -494,7 +520,7 @@
         },
       ]
     `);
     expect(associateCall![0].input).toMatchInlineSnapshot(`
       {
         "apiId": "123456789",
         "domainName": "api.example.com",
@@ -554,7 +580,7 @@
         },
       ]
     `);
     expect(associateCall![0].input).toMatchInlineSnapshot(`
       {
         "apiId": "123456789",
         "domainName": "api.example.com",
@@ -613,7 +639,7 @@
         },
       ]
     `);
     expect(disassocCall![0].input).toMatchInlineSnapshot(`
       {
         "domainName": "api.example.com",
       }
@@ -672,7 +698,7 @@
         },
       ]
     `);
     expect(disassocCall![0].input).toMatchInlineSnapshot(`
       {
         "domainName": "api.example.com",
       }

src/index.ts

@@ -715,6 +715,14 @@ class ServerlessAppsyncPlugin {
         );
       }
 
+      if (typeof certificateArn !== 'string') {
+        throw new this.serverless.classes.Error(
+          `Invalid \`certificateArn\`: the \`appsync domain\` CLI commands require a plain ARN string. ` +
+            `CloudFormation intrinsic functions (e.g. Fn::ImportValue) can only be resolved by CloudFormation, not by the CLI. ` +
+            `Either pass a literal ARN, or manage the domain through CloudFormation (the default, \`domain.useCloudFormation: true\`), where the intrinsic function will be resolved.`,
+        );
+      }
+
       await this.clientFactory.getAppSyncClient().send(
         new CreateDomainNameCommand({
           domainName: domain.name,

src/types/common.ts

@@ -119,7 +119,7 @@ export type DomainConfig = {
   useCloudFormation?: boolean;
   retain?: boolean;
   name: string;
-  certificateArn?: string;
+  certificateArn?: string | IntrinsicFunction;
   hostedZoneId?: string;
   hostedZoneName?: string;
   route53?: boolean;