PropertyOverrides: Tokens not properly resolved in cross stack scenarios when using property overrides

[Poweranimal]

What is the problem?

Tokens that a are passed from one stack into another are not properly resolved in methods like CfnResource.addPropertyOverride.

Reproduction Steps

import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as lambda from "aws-cdk-lib/aws-lambda";

const app = new cdk.App();

const stackA = new cdk.Stack(app, "StackA");
const vpc = new ec2.Vpc(stackA, "Vpc");

const stackB = new cdk.Stack(app, "StackB");
const fn = new lambda.Function(stackB, "Lambda", {
    runtime: lambda.Runtime.NODEJS_14_X,
    handler: "index.js",
    code: lambda.Code.fromInline("hello"),
});
const cfnFn = (fn.node.defaultChild as cdk.CfnResource);
cfnFn.addPropertyOverride("VpcConfig", {
    subnetIds: vpc.selectSubnets({subnetType: ec2.SubnetType.PRIVATE_WITH_NAT}).subnetIds,
});

// Uncommenting the below code will make it work.
// vpc.selectSubnets({subnetType: ec2.SubnetType.PRIVATE_WITH_NAT}).subnets.forEach((v, i) => {
//     new cdk.CfnResource(stackB, `Res${i}`, {
//         type: "Custom::DeleteMe",
//         properties: {
//             SubnetId: v.subnetId,
//         }
//     });
// });

What did you expect to happen?

The generated StackB should have an AWS::Lambda::Function with this VpcConfig:

...
"VpcConfig": {
  "subnetIds": [
    {
      "Fn::ImportValue": "StackA:ExportsOutputRefVpcPrivateSubnet1Subnet536B997AFD4CC940"
    },
    {
      "Fn::ImportValue": "StackA:ExportsOutputRefVpcPrivateSubnet2Subnet3788AAA1380949A3"
    }
  ]
}
...

What actually happened?

...
"VpcConfig": {
  "subnetIds": [
    {
      "Ref": "VpcPrivateSubnet1Subnet536B997A"
    },
    {
      "Ref": "VpcPrivateSubnet2Subnet3788AAA1"
    }
  ]
}
...

CDK CLI Version

2.10.0 (build e5b301f)

Framework Version

No response

Node.js Version

v14.18.3

OS

Linux

Language

Typescript

Language Version

No response

Other information

There must be a simple workaround, because if one uses the selected subnets in StackB as properties for another resource inside the same Stack, all Tokens, including the ones of the addPropertyOverride, get resolved properly.

[johnameyer]

Any update here? Happy to implement with some guidance (especially around how token resolution works)

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.