aws-efs: FileSystem deployment fails if vpcSubnets are referenced from existing subnets

[vumdao]

Describe the feature

Code

    const efs = new FileSystem(this, 'FileSystem', {
      vpc,
      encrypted: true,
      lifecyclePolicy: LifecyclePolicy.AFTER_7_DAYS,
      vpcSubnets: { subnets: [ Subnet.fromSubnetAttributes(this, subnetId, {subnetId: subnetId, availabilityZone: az}) ] },
      removalPolicy: RemovalPolicy.DESTROY,
    });

Error:

Error: Resolution error: ID components may not include unresolved tokens: EfsMountTarget-${Token[TOKEN.1221]}.
Object creation stack:
  at Execute again with CDK_DEBUG=true to capture stack traces
    at makeUniqueId (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/private/uniqueid.js:1:660)
    at orgStack.allocateLogicalId (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/stack.js:1:19234)
    at orgStack.getLogicalId (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/stack.js:1:8662)
    at CfnMountTarget.synthesizeLogicalId (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/cfn-element.js:2:687)
    at Object.produce (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/cfn-element.js:1:915)
    at LazyString.resolve (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/lazy.js:1:4176)
    at RememberingTokenResolver.resolveToken (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/resolvable.js:1:1401)
    at RememberingTokenResolver.resolveToken (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:4116)
    at resolve (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:2747)
    at Object.resolve (/Users/dev/workspace/github/org/core/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:1115)```

Related: https://github.com/aws/aws-cdk/pull/26155 where I see it uses `EfsMountTarget-${subnet.node.id}` as the stack ID of mount target

### Use Case

Create FileSystem with subnets from references

### CDK version used

2.185.0

### Environment details (OS name and version, etc.)

macOS Sequoia 15.3.2

[pahud]

Current/Expected Behavior

Affected Source Code

The issue occurs in packages/aws-cdk-lib/aws-efs/lib/efs-file-system.ts, specifically in the FileSystem constructor where mount targets are created. Here's the problematic code section:

aws-cdk/packages/aws-cdk-lib/aws-efs/lib/efs-file-system.ts

Line 867 in 2dc5d70

`EfsMountTarget-${subnet.node.id}`,

The problem occurs when:

1. The useMountTargetOrderInsensitiveLogicalID feature flag is enabled (default in CDK v2)
2. A subnet is imported using Subnet.fromSubnetAttributes
3. The code then tries to use subnet.node.id in the mount target ID, but it contains unresolved tokens

Possible Fix

// We now have to create the mount target for each of the mentioned subnet

// we explicitly use FeatureFlags to maintain backwards compatibility
const useMountTargetOrderInsensitiveLogicalID = FeatureFlags.of(this).isEnabled(cxapi.EFS_MOUNTTARGET_ORDERINSENSITIVE_LOGICAL_ID);
this.mountTargetsAvailable = [];
if (useMountTargetOrderInsensitiveLogicalID) {
  let mountTargetCount = 0; // Fallback counter for cases with tokens
  subnets.subnets.forEach((subnet) => {
    // Check if subnet.node.id contains tokens or if we're dealing with an imported subnet
    const containsTokens = Token.isUnresolved(subnet.node.id);
    const mountTargetId = containsTokens 
      ? `EfsMountTarget-${++mountTargetCount}` // Fallback to counter-based ID if tokens present
      : `EfsMountTarget-${subnet.node.id}`;    // Use subnet.node.id when safe
      
    const mountTarget = new CfnMountTarget(this,
      mountTargetId,
      {
        fileSystemId: this.fileSystemId,
        securityGroups: Array.of(securityGroup.securityGroupId),
        subnetId: subnet.subnetId,
      });
    this._mountTargetsAvailable.add(mountTarget);
  });
} else {
  let mountTargetCount = 0;
  subnets.subnetIds.forEach((subnetId: string) => {
    const mountTarget = new CfnMountTarget(this,
      'EfsMountTarget' + (++mountTargetCount),
      {
        fileSystemId: this.fileSystemId,
        securityGroups: Array.of(securityGroup.securityGroupId),
        subnetId,
      });
    this._mountTargetsAvailable.add(mountTarget);
  });
}

The fix adds logic to:

1. Check if subnet.node.id contains unresolved tokens using Token.isUnresolved()
2. If it contains tokens, fallback to a counter-based ID approach (similar to the non-feature flag case)
3. Only use the subnet's node.id in the ID when it's safe to do so (doesn't contain tokens)

Making this a p1 and we welcome PRs.