AWS policy for step functions: some actions, resources, or conditions do not provide permissions

0

I am editing a policy document to allow Lambda sending TaskSuccess to a step function. A statement below, although granting the right permissions, causes the warning to appear. I need advice if this is a "false positive" warning, or I am actually misconfiguring a policy document.

Statement that causes the warning:

    {
      "Sid": "VisualEditor2",
      "Effect": "Allow",
      "Action": [
        "states:SendTaskSuccess",
        "states:SendTaskFailure"
      ],
      "Resource": "arn:aws:states:eu-central-1:xxxxxxxxxxxx:stateMachine:sample-waiting-step-machine"
    }

Warning text:

This policy defines some actions, resources, or conditions 
that do not provide permissions. To grant access, policies 
must have an action that has an applicable resource or condition. 
For details, choose Show remaining.

Once I tick "show remaining services", the following warning shows up in the table warning

1개 답변
1
수락된 답변

Hi,

According to the following AWS Github repository issue, you should use Resources: "*" for this policy.

According to https://docs.aws.amazon.com/step-functions/latest/dg/concept-create-iam-advanced.html, Step Function API calls to update task status require "the ARN of the activity or the token of the instance as part of the request". Since the token is provided as an input to the worker Lambda function, I think it's safe to use Resources: "*" for this policy.

profile picture
전문가
답변함 8달 전
profile picture
전문가
검토됨 8달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠