Read parameters across AWS Regions with AWS CloudFormation custom resources

import * as route53 from 'aws-cdk-lib/aws-route53';
import * as acm from 'aws-cdk-lib/aws-certificatemanager';
import { CfnOutput, Stack } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { StringParameter } from 'aws-cdk-lib/aws-ssm'

export interface StaticSiteProps {
    domainName: string;
    siteSubDomain: string;
}
export class CertificateStack extends Construct {
    constructor(parent: Stack, name: string, props: StaticSiteProps) {
        super(parent, name);

        const zone = route53.HostedZone.fromLookup(this, 'Zone', { domainName: props.domainName });
        const siteDomain = props.siteSubDomain + '.' + props.domainName;

        new CfnOutput(this, 'Site', { value: 'https://' + siteDomain });

        // TLS certificate
        const certificateArn = new acm.DnsValidatedCertificate(this, 'SiteCertificate', {
            domainName: siteDomain,
            hostedZone: zone,
            region: 'us-east-1', // Cloudfront only checks this region for certificates.
        }).certificateArn;
        new CfnOutput(this, 'Certificate', { value: certificateArn });

        new StringParameter(this, 'CertificateARN', {
            parameterName: "CERTIFICATE_ARN",
            description: 'Certificate ARN to be used with Cloudfront',
            stringValue: certificateArn
        });
    }
}

The code in certificate-stack.ts does the following:

import * as route53 from 'aws-cdk-lib/aws-route53';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as s3deploy from 'aws-cdk-lib/aws-s3-deployment';
import * as targets from 'aws-cdk-lib/aws-route53-targets';
import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
import * as iam from 'aws-cdk-lib/aws-iam';
import { Aws, CfnOutput, RemovalPolicy, Stack } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { SSMParameterReader } from './ssm-parameter-reader';
export interface StaticSiteProps {
    domainName: string;
    siteSubDomain: string;
}
export class S3Stack extends Construct {
    constructor(parent: Stack, name: string, props: StaticSiteProps) {
        super(parent, name);

        const zone = route53.HostedZone.fromLookup(this, 'Zone', { domainName: props.domainName });
        const siteDomain = props.siteSubDomain + '.' + props.domainName;
        const cloudfrontOAI = new cloudfront.OriginAccessIdentity(this, 'cloudfront-OAI', {
            comment: `OAI for ${name}`
        });

        new CfnOutput(this, 'Site', { value: 'https://' + siteDomain });

        // Content bucket
        const siteBucket = new s3.Bucket(this, 'SiteBucket', {
            bucketName: siteDomain,
            websiteIndexDocument: 'index.html',
            websiteErrorDocument: 'error.html',
            publicReadAccess: false,
            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
     removalPolicy: RemovalPolicy.RETAIN, 

            autoDeleteObjects: false,
        });
        // Grant access to cloudfront
        siteBucket.addToResourcePolicy(new iam.PolicyStatement({
            actions: ['s3:GetObject'],
            resources: [siteBucket.arnForObjects('*')],
            principals: [new iam.CanonicalUserPrincipal(cloudfrontOAI.cloudFrontOriginAccessIdentityS3CanonicalUserId)]
        }));
        new CfnOutput(this, 'Bucket', { value: siteBucket.bucketName });

        const certificateArnReader = new SSMParameterReader(this, 'CertificateARNReader', {
            parameterName: "CERTIFICATE_ARN",
            region: 'us-east-1'
        });

        const webAclIdReader = new SSMParameterReader(this, 'WebAclIdReader', {
            parameterName: "WEBACL_ID",
            region: 'us-east-1'
        });
        new CfnOutput(this, 'Certificate', { value: certificateArnReader.getParameterValue() });

        const viewerCertificate = cloudfront.ViewerCertificate.fromAcmCertificate({
            certificateArn: certificateArnReader.getParameterValue(),
            env: {
                region: Aws.REGION,
                account: Aws.ACCOUNT_ID
            },
            node: this.node,
            stack: parent,
            metricDaysToExpiry: () => new cloudwatch.Metric({
                namespace: "TLS Viewer Certificate Validity",
                metricName: "TLS Viewer Certificate Expired",
            }),
            applyRemovalPolicy: function (policy: RemovalPolicy): void {
                throw new Error('Function not implemented.');
            }
        },
            {
                sslMethod: cloudfront.SSLMethod.SNI,
                securityPolicy: cloudfront.SecurityPolicyProtocol.TLS_V1_1_2016,
                aliases: [siteDomain]
            })

        // CloudFront distribution
        const distribution = new cloudfront.CloudFrontWebDistribution(this, 'SiteDistribution', {
            viewerCertificate,
            originConfigs: [
                {
                    s3OriginSource: {
                        s3BucketSource: siteBucket,
                        originAccessIdentity: cloudfrontOAI
                    },
                    behaviors: [{
                        isDefaultBehavior: true,
                        compress: true,
                        allowedMethods: cloudfront.CloudFrontAllowedMethods.GET_HEAD_OPTIONS,
                    }],
                }
            ],
            webACLId: webAclIdReader.getParameterValue()
        });
        new CfnOutput(this, 'DistributionId', { value: distribution.distributionId });

        // Route53 alias record for the CloudFront distribution
        new route53.ARecord(this, 'SiteAliasRecord', {
            recordName: siteDomain,
            target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(distribution)),
            zone
        });

        // Deploy site contents to S3 bucket
        new s3deploy.BucketDeployment(this, 'DeployWithInvalidation', {
            sources: [s3deploy.Source.asset('./site-contents')],
            destinationBucket: siteBucket,
            distribution,
            distributionPaths: ['/*'],
        });

    }
}

<!doctype html>
<html>
  <head>
    <title>This is the title of the webpage!</title>
  </head>
  <body>
    <p>This is an example paragraph. Anything in the <strong>body</strong> tag will appear on the page, just like this <strong>p</strong> tag and its contents.</p>
  </body>
</html>

import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { S3Stack } from '../lib/s3-stack';
import { CertificateStack } from '../lib/certificate-stack';
import { WafStack } from '../lib/waf-stack';
class MyStaticSiteStack extends cdk.Stack {
  constructor(parent: cdk.App, name: string, props: cdk.StackProps) {
    super(parent, name, props);

    new S3Stack(this, 'StaticSite', {
      domainName: "DOMAIN_NAME",
      siteSubDomain: "www",
    });
  }
}

class MyCertificateStack extends cdk.Stack {
  constructor(parent: cdk.App, name: string, props: cdk.StackProps) {
    super(parent, name, props);

    new CertificateStack(this, 'CertificateStack', {
      domainName: "DOMAIN_NAME",
      siteSubDomain: "www",
    });
  }
}

class MyWafStack extends cdk.Stack {
  constructor(parent: cdk.App, name: string, props: cdk.StackProps) {
    super(parent, name, props);

    new WafStack(this, 'WafStack', {});
  }
}

const app = new cdk.App();

async function main() {

  const certificateStack = new MyCertificateStack(app, 'MyCertificateStack', {
    env: {
      account: "ACCOUNT_ID",
      region: 'us-east-1',
    }
  });

  const wafStack = new MyWafStack(app, 'MyWafStack', {
    env: {
      account: "ACCOUNT_ID",
      region: 'us-east-1',
    }
  });

  const mySiteStack = new MyStaticSiteStack(app, 'MyStaticSite', {
    
    env: {
      account: "ACCOUNT_ID",
      region: 'eu-central-1',
    }
  })
  mySiteStack.addDependency(certificateStack);
  mySiteStack.addDependency(wafStack);
  app.synth();

}

main();