aws / aws/aws-cdk

stepfunctions: using `itemProcessor` with `mode = DISTRIBUTED` doesn't work out of the box due to permission error

Open
#28,820 11 comments 7 reactions 0 assignees View on GitHub
@aws-cdk/aws-stepfunctions bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Deploying a map state in a state machine using distributed processing mode (and standard execution type for the child executions) causes an IAM permissions issue since the parent state machine role doesn't have permission to start executions on itself. Trying to grant permissions via `stateMachine.grantStartExecution(stateMachine)` causes a circular dependency.

### Expected Behavior

When using distributed processing mode, necessary permissions should be generated by default.

### Current Behavior

Start execution permission for the child executions is not granted to the parent state machine.

### Reproduction Steps

```javascript
const mapState = new Map(this, 'Map State', {
itemsPath: JsonPath.stringAt('$...'),
maxConcurrency: 100,
parameters: {
...
}
})
mapListings.itemProcessor(..., {
executionType: ProcessorType.STANDARD,
mode: ProcessorMode.DISTRIBUTED
})
```

### Possible Solution

Automatically add the necessary IAM policy to the parent state machine's default role

### Additional Information/Context

_No response_

### CDK CLI Version

2.122.0 (build 7e77e02)

### Framework Version

_No response_

### Node.js Version

v18.16.1

### OS

MacOS Sonoma 14.0 (M2 Pro)

### Language

TypeScript

### Language Version

_No response_

### Other information

technically I am using vanilla JS CDK language but that's not an option in the language dropdown.

Contributor guide

Open the contributing guide

Research direction

Start from the Map state's itemProcessor entry point and reproduce the DISTRIBUTED mode with STANDARD child executions from the issue. Inspect the generated parent state machine role permissions and dependency graph; done means the parent can start child executions by default without requiring a circular grantStartExecution dependency.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.