aws / aws/aws-cdk

Step Functions - support calling nested dynamic State Machine

Open
#6,023 11 comments 13 reactions 0 assignees View on GitHub
@aws-cdk/aws-stepfunctions effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

## Description
Note: Bug occurs with the experimental library `@aws-cdk/aws-stepfunctions`

When creating a state machine with a nested workflow task, whose StateMachineArn is a dynamic value set using a JSONPath query, the stepfunctions CDK library recognizes the nested workflow task ARN as dynamic and suffixes `StateMachineArn` with `.$` correctly.

However, the library doesn't realize that the ARN provided is a dynamic value when generating default policies for the state machine. As a result, it generates a policy statement for the state machine with the action "states:StartExecution" so that the state machine can execute nested workflows (which is a good thing), but sets the resource field to the dynamic value (which is a bad thing).

## Reproduction Steps
Reproduction Repo: https://github.com/sabarnac/cdk-stepfunctions-bug-repo

Steps:
1. Run `npm run cdk synth`/`cdk synth`
2. Open `./cdk.out/CdkStepfunctionsBugRepoStack.template.json`
3. Search for `SampleStateMachineRoleDefaultPolicy`
4. Check the first policy statement
```json
{
"Action": "states:StartExecution",
"Effect": "Allow",
"Resource": "$.dynamicArn"
}
```

### Stack Code:
```ts
import * as sfn from "@aws-cdk/aws-stepfunctions";
import * as tasks from "@aws-cdk/aws-stepfunctions-tasks";
import * as cdk from "@aws-cdk/core";

export class CdkStepfunctionsBugRepoStack extends cdk.Stack {
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const stepFunctionsTask = new sfn.Task(this, "NestedWorkflowTask", {
task: new tasks.StartExecution(
sfn.StateMachine.fromStateMachineArn(this, "NestedWorkflowStateMachine", sfn.Data.stringAt("$.dynamicArn")),
{
input: {
"input.$": "$.dynamicInput",
"AWS_STEP_FUNCTIONS_STARTED_BY_EXECUTION_ID.$": "$$.Execution.Id",
},
name: sfn.Data.stringAt("$.dynamicName"),
integrationPattern: sfn.ServiceIntegrationPattern.SYNC,
},
),
resultPath: "$.workflowResult",
})

new sfn.StateMachine(this, "SampleStateMachine", {
definition: stepFunctionsTask,
});
}
}
```

### Error Log

None.

### Environment

- **CLI Version :** 1.22.0 (build 309ac1b)
- **Framework Version:**
- `@aws-cdk/aws-stepfunctions-tasks`: 1.22.0
- `@aws-cdk/aws-stepfunctions`: 1.22.0
- `@aws-cdk/core`: 1.22.0
- **OS :** Mac OS Mojave [10.14.6 (18G2022)]
- **Language :** TypeScript

### Other
No other details

---

This is :bug: Bug Report

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the provided TypeScript stack and run `npm run cdk synth` or `cdk synth`. Inspect `cdk.out/CdkStepfunctionsBugRepoStack.template.json`, especially `SampleStateMachineRoleDefaultPolicy`, and trace the nested workflow handling in `@aws-cdk/aws-stepfunctions` and `@aws-cdk/aws-stepfunctions-tasks`; done means the generated `states:StartExecution` policy handles the dynamic ARN correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.