stepfunctions: using `itemProcessor` with `mode = DISTRIBUTED` doesn't work out of the box due to permission error
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Deploying a map state in a state machine using distributed processing mode (and standard execution type for the child executions) causes an IAM permissions issue since the parent state machine role doesn't have permission to start executions on itself. Trying to grant permissions via `stateMachine.grantStartExecution(stateMachine)` causes a circular dependency.
### Expected Behavior
When using distributed processing mode, necessary permissions should be generated by default.
### Current Behavior
Start execution permission for the child executions is not granted to the parent state machine.
### Reproduction Steps
```javascript
const mapState = new Map(this, 'Map State', {
itemsPath: JsonPath.stringAt('$...'),
maxConcurrency: 100,
parameters: {
...
}
})
mapListings.itemProcessor(..., {
executionType: ProcessorType.STANDARD,
mode: ProcessorMode.DISTRIBUTED
})
```
### Possible Solution
Automatically add the necessary IAM policy to the parent state machine's default role
### Additional Information/Context
_No response_
### CDK CLI Version
2.122.0 (build 7e77e02)
### Framework Version
_No response_
### Node.js Version
v18.16.1
### OS
MacOS Sonoma 14.0 (M2 Pro)
### Language
TypeScript
### Language Version
_No response_
### Other information
technically I am using vanilla JS CDK language but that's not an option in the language dropdown.
Contributor guide
Research direction
Start from the Map state's itemProcessor entry point and reproduce the DISTRIBUTED mode with STANDARD child executions from the issue. Inspect the generated parent state machine role permissions and dependency graph; done means the parent can start child executions by default without requiring a circular grantStartExecution dependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authorization, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100