fix(docdb): allow unresolved subnet lists in database clusters

packages/aws-cdk-lib/aws-docdb/lib/cluster.ts

@@ -532,7 +532,7 @@ export class DatabaseCluster extends DatabaseClusterBase {
     // DocDB clusters require a subnet group with subnets from at least two AZs.
     // We cannot test whether the subnets are in different AZs, but at least we can test the amount.
     // See https://docs.aws.amazon.com/documentdb/latest/developerguide/replication.html#replication.high-availability
-    if (subnetIds.length < 2) {
+    if (!Token.isUnresolved(subnetIds) && subnetIds.length < 2) {
       throw new ValidationError(lit`ClusterRequiresAtLeastTwoSubnets`, `Cluster requires at least 2 subnets, got ${subnetIds.length}`, this);
     }
 

packages/aws-cdk-lib/aws-docdb/test/cluster.test.ts

@@ -138,6 +138,36 @@ describe('DatabaseCluster', () => {
     }).toThrow('Cluster requires at least 2 subnets, got 1');
   });
 
+  test('accepts an unresolved list of subnet IDs', () => {
+    // GIVEN
+    const stack = testStack();
+    const vpc = ec2.Vpc.fromVpcAttributes(stack, 'VPC', {
+      vpcId: 'vpc-12345',
+      availabilityZones: cdk.Fn.split(',', cdk.Fn.importValue('AvailabilityZones')),
+      privateSubnetIds: cdk.Fn.split(',', cdk.Fn.importValue('PrivateSubnetIds')),
+    });
+
+    // WHEN
+    new DatabaseCluster(stack, 'Database', {
+      instances: 1,
+      masterUser: {
+        username: 'admin',
+      },
+      vpc,
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.R5, ec2.InstanceSize.LARGE),
+      vpcSubnets: {
+        subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+      },
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::DocDB::DBSubnetGroup', {
+      SubnetIds: {
+        'Fn::Split': [',', { 'Fn::ImportValue': 'PrivateSubnetIds' }],
+      },
+    });
+  });
+
   test('secret attachment target type is correct', () => {
     // GIVEN
     const stack = testStack();