fix(cloudfront): Function ARN reference changed from GetAtt to Ref (#35547)

When copying the underlying `CfnFunction`'s implementation of `IFunctionRef`, the source of the `functionArn` value changed from a `{ GetAtt }` to a `{ Ref }`.

Both expression return the same value, but if the ARN is exported to another stack, CloudFormation will reject any change to the expression under the assumption that `different expression ⇒ different value`, and that's not allowed.

Override the implementation for the L2, returning the same expression as previously.

Closes #35531

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: rix0rrr

packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-function-runtime.js.snapshot/integ-distribution-function.template.json

@@ -35,13 +35,19 @@
        {
         "EventType": "viewer-request",
         "FunctionARN": {
-         "Ref": "FunctionRequest95528B2F"
+         "Fn::GetAtt": [
+          "FunctionRequest95528B2F",
+          "FunctionARN"
+         ]
         }
        },
        {
         "EventType": "viewer-response",
         "FunctionARN": {
-         "Ref": "FunctionResponse4EF2D1D3"
+         "Fn::GetAtt": [
+          "FunctionResponse4EF2D1D3",
+          "FunctionARN"
+         ]
         }
        }
       ],

packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-function.js.snapshot/integ-distribution-function.template.json

@@ -23,7 +23,10 @@
        {
         "EventType": "viewer-request",
         "FunctionARN": {
-         "Ref": "Function76856677"
+         "Fn::GetAtt": [
+          "Function76856677",
+          "FunctionARN"
+         ]
         }
        }
       ],

packages/aws-cdk-lib/aws-cloudfront/lib/function.ts

@@ -223,9 +223,11 @@ export class Function extends Resource implements IFunction {
       name: this.functionName,
     });
 
-    this.functionRef = resource.functionRef;
     this.functionArn = resource.attrFunctionArn;
     this.functionStage = resource.attrStage;
+    this.functionRef = {
+      functionArn: this.functionArn,
+    };
   }
 
   private generateName(): string {

packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts

@@ -920,7 +920,10 @@ describe('with CloudFront functions', () => {
             {
               EventType: 'viewer-request',
               FunctionARN: {
-                Ref: 'TestFunction22AD90FC',
+                'Fn::GetAtt': [
+                  'TestFunction22AD90FC',
+                  'FunctionARN',
+                ],
               },
             },
           ],

packages/aws-cdk-lib/aws-cloudfront/test/function.test.ts

@@ -292,5 +292,24 @@ describe('CloudFront Function', () => {
         },
       });
     });
+
+    test('CloudFront FunctionRef uses GetAtt, not Ref', () => {
+      // Both GetAtt and Ref are valid ways to satisfy the contract, but only
+      // GetAtt is backwards compatible.
+      const stack = new Stack();
+
+      const fn = new Function(stack, 'TestFn', {
+        code: FunctionCode.fromInline('code'),
+        runtime: FunctionRuntime.JS_2_0,
+        keyValueStore: undefined,
+      });
+
+      expect(stack.resolve(fn.functionRef.functionArn)).toEqual({
+        'Fn::GetAtt': [
+          'TestFn04335C60',
+          'FunctionARN',
+        ],
+      });
+    });
   });
 });

packages/aws-cdk-lib/aws-cloudfront/test/web-distribution.test.ts

@@ -810,7 +810,10 @@ added the ellipsis so a user would know there was more to r...`,
             {
               'EventType': 'viewer-request',
               'FunctionARN': {
-                'Ref': 'TestFunction22AD90FC',
+                'Fn::GetAtt': [
+                  'TestFunction22AD90FC',
+                  'FunctionARN',
+                ],
               },
             },
           ],