fix(docdb): allow unresolved subnet lists in database clusters

[fukunaga-kengo]

Issue # (if applicable)

Closes #14262.

Reason for this change

DatabaseCluster checks the number of selected subnet IDs during synthesis. An unresolved list, such as Fn::Split over an imported value, is represented by a one-element token marker and is therefore incorrectly rejected as a single-subnet configuration.

Description of changes

• Skip the subnet-count validation when the subnet ID list is unresolved.
• Preserve the existing validation and error for concrete lists with fewer than two subnet IDs.
• Add a regression test that verifies the unresolved Fn::Split/Fn::ImportValue expression is passed to AWS::DocDB::DBSubnetGroup.SubnetIds.

  unresolved subnet list                 concrete subnet list
            |                                      |
            v                                      v
  +----------------------+                +----------------------+
  | skip count validation|                | validate list length |
  +----------+-----------+                +----------+-----------+
             |                                       |
             v                                       v
  CfnDBSubnetGroup.SubnetIds                error when length < 2

This change is backward-compatible. It does not change public APIs, construct IDs, feature flags, or templates for inputs that already synthesize successfully. It only allows deploy-time subnet lists that were previously rejected during synthesis.

Describe any new or updated permissions being added

No new or updated permissions are added.

• IAM permissions: none
• Resource access: none
• Security behavior: unchanged; DocumentDB and CloudFormation continue to validate the resolved subnet configuration

Description of how you validated changes

• Unit tests: Added a regression test for an unresolved Fn::Split/Fn::ImportValue subnet list. The test failed with the reported error before the fix and passes after it. The targeted suite passes with 62 tests, and the aws-docdb module suite passes with 4 suites and 80 tests.
• Integration tests: No new integration test is needed because this is a synthesis-only token-handling fix with no new resource, property, or cross-service integration. All seven existing DocumentDB integration snapshot checks pass unchanged.
• Quality checks: The full aws-cdk-lib build, aws-cdk-lib lint, framework-integ lint, TypeScript --noEmit check, and git diff --check pass.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

---

Additional Context

Related Issues

• (vpc): context lookup does not occur/complete before vpc is referenced in other constructs #22025 discusses broader VPC context lookup timing but does not cover this token-safety defect.

Dependencies

No dependency changes.

Documentation Updates

No README or API documentation update is required. This bug fix changes only synthesis-time handling of an existing input form; it introduces no public API, configuration option, or usage pattern, and it does not correct an inaccurate README example. Rosetta validation is therefore not applicable.

Follow-up Work

None identified.

Review Guidelines

Focus Areas

• Confirm that Token.isUnresolved(subnetIds) guards only the count validation.
• Confirm that concrete one-subnet lists still raise the existing validation error.
• Confirm that the unresolved intrinsic is preserved in AWS::DocDB::DBSubnetGroup.SubnetIds.

Testing Notes

The regression test asserts the exact Fn::Split and Fn::ImportValue structure instead of using a broad matcher.

Risk Assessment

Risk is low. Existing synthesizable applications retain their current templates, and the DocumentDB two-Availability-Zone requirement is unchanged. The only newly accepted path defers validation of an unresolved list to CloudFormation and the service.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[fukunaga-kengo]

Exemption Request: This change only adds a Token.isUnresolved() guard to a synthesis-time subnet-count validation. The regression is fully covered by a unit test that verifies the exact Fn::Split/Fn::ImportValue expression is preserved in AWS::DocDB::DBSubnetGroup.SubnetIds. It introduces no new resource, property, or deployment behavior, and all existing DocumentDB integration snapshots remain unchanged.