-
Notifications
You must be signed in to change notification settings - Fork 3.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
aws-cdk-lib/aws-stepfunctions-tasks: Issue with incorrectly generated IAM policy. #30862
aws-cdk-lib/aws-stepfunctions-tasks: Issue with incorrectly generated IAM policy. #30862
Comments
Reproducible using below code: import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as sfn from 'aws-cdk-lib/aws-stepfunctions';
import * as tasks from 'aws-cdk-lib/aws-stepfunctions-tasks';
export class Issue30862Stack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const callAwsServiceTask = new tasks.CallAwsService(this, 'TagEfsAccessPoint', {
stateName: 'Tag access point',
service: 'efs',
action: 'tagResource',
iamResources: ['*'],
parameters: {
ResourceId: sfn.JsonPath.stringAt('$.pathToArn'),
Tags: [
{
Key: "MYTAGNAME",
Value: sfn.JsonPath.stringAt('$.pathToId')
}
]
},
resultPath: sfn.JsonPath.DISCARD
});
const stateMachine = new sfn.StateMachine(this, 'MyStateMachine', {
definition: callAwsServiceTask.next(new sfn.Succeed(this, "GreetedWorld"))
});
}
} Running Resources:
MyStateMachineRoleD59FFEBC:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: states.amazonaws.com
Version: "2012-10-17"
Metadata:
aws:cdk:path: Issue30862Stack/MyStateMachine/Role/Resource
MyStateMachineRoleDefaultPolicyE468EB18:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action: efs:tagResource
Effect: Allow
Resource: "*"
Version: "2012-10-17"
PolicyName: MyStateMachineRoleDefaultPolicyE468EB18
Roles:
- Ref: MyStateMachineRoleD59FFEBC
Metadata:
aws:cdk:path: Issue30862Stack/MyStateMachine/Role/DefaultPolicy/Resource
MyStateMachine6C968CA5:
Type: AWS::StepFunctions::StateMachine
Properties:
DefinitionString:
Fn::Join:
- ""
- - '{"StartAt":"Tag access point","States":{"Tag access point":{"Next":"GreetedWorld","Type":"Task","ResultPath":null,"Resource":"arn:'
- Ref: AWS::Partition
- :states:::aws-sdk:efs:tagResource","Parameters":{"ResourceId.$":"$.pathToArn","Tags":[{"Key":"MYTAGNAME","Value.$":"$.pathToId"}]}},"GreetedWorld":{"Type":"Succeed"}}}
RoleArn:
Fn::GetAtt:
- MyStateMachineRoleD59FFEBC
- Arn
DependsOn:
- MyStateMachineRoleDefaultPolicyE468EB18
- MyStateMachineRoleD59FFEBC
UpdateReplacePolicy: Delete
DeletionPolicy: Delete
Metadata:
aws:cdk:path: Issue30862Stack/MyStateMachine/Resource
... Per TagResource, the operation requires permissions for the Possible root cause:
Possible fix: WorkAround: const callAwsServiceTask = new tasks.CallAwsService(this, 'TagEfsAccessPoint', {
stateName: 'Tag access point',
service: 'efs',
action: 'tagResource',
iamResources: ['*'],
iamAction: 'elasticfilesystem:TagResource',
parameters: {
ResourceId: sfn.JsonPath.stringAt('$.pathToArn'),
Tags: [
{
Key: "MYTAGNAME",
Value: sfn.JsonPath.stringAt('$.pathToId')
}
]
},
resultPath: sfn.JsonPath.DISCARD
}); and it works: ...
MyStateMachineRoleDefaultPolicyE468EB18:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action: elasticfilesystem:TagResource
Effect: Allow
Resource: "*"
Version: "2012-10-17"
PolicyName: MyStateMachineRoleDefaultPolicyE468EB18
Roles:
- Ref: MyStateMachineRoleD59FFEBC
Metadata:
aws:cdk:path: Issue30862Stack/MyStateMachine/Role/DefaultPolicy/Resource
... |
Hi @ashishdhingra, I would like to work on this issue! |
@ishon19 Thanks for your reply. I will most likely submit PR for this issue soon. :) |
Yeah, sure! =) |
Comments on closed issues and PRs are hard for our team to see. |
1 similar comment
Comments on closed issues and PRs are hard for our team to see. |
Describe the bug
I am working on writing a CDK based step function with a task to call 'tagresources' on an EFS access point:
Produces an incorrect a IAM policy snippet.
Expected Behavior
It should be (ref):
Current Behavior
Produces:
Which is incorrect, it should be (ref):
Reproduction Steps
Create the following task as part of a CDK defined state machine:
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.147.2
Framework Version
No response
Node.js Version
20
OS
macOS
Language
TypeScript
Language Version
TypeScript (5.4.2)
Other information
No response
The text was updated successfully, but these errors were encountered: