fix(stepfunctions-tasks): cloudwatchlogs service generates wrong action in role policy

[go-to-k]

This PR fixes the bug that a wrong action in role policy is generated when cloudwatchlogs service is specified.

A correct action is logs:xxx, but current behavior is to cloudwatchlogs:xxx by using the service property.

Closes #27573.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[scanlonp]

Hey @go-to-k, this change looks great. Before approval, do you have a link to docs that state the correct action is logs:createLogStream?
Also in the original issue, the user states that the action should be logs:CreateLogStream with a capital C on Create. Another case where the docs would be helpful in confirming the correct action is being created.

[go-to-k]

@scanlonp

Thanks for your review. It cannot be pascal case like logs:CreateLogStream with a capital C on Create for the following reasons.

At first, the following description is in the UserGuide reference.

The prefix and the action name are case insensitive.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.html

The documentation link is also in the CDK codes.

aws-cdk/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/aws-sdk/call-aws-service.ts

Lines 92 to 94 in 09c809b

	// The prefix and the action name are case insensitive
	// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.html
	actions: [props.iamAction ?? `${iamService}:${props.action}`],

But the IAM actions are case insensitive, while StepFunctions SDK service integrations are case sensitive for API actions. The actions for StepFunctions must be camel case only. Also, by default, the action property for StepFunctions is used in IAM policies. So the action names as camel case will be used in the IAM actions.

aws-cdk/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/aws-sdk/call-aws-service.ts

Lines 21 to 26 in 09c809b

	/**
	* The API action to call.
	*
	* Use camelCase.
	*/
	readonly action: string;

The API action will always be camel case, and parameter names will be Pascal case. For example, you could use Step Functions API action startSyncExecution and specify its parameter as StateMachineArn.

https://docs.aws.amazon.com/step-functions/latest/dg/supported-services-awssdk.html

So, if you use CreateLogStream (Pascal case) for the action in CDK props, an error will occur in StepFunction definitions.

Deployment failed: Error: The stack named aws-stepfunctions-tasks-call-aws-service-logs-integ failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Invalid State Machine Definition: 'SCHEMA_VALIDATION_FAILED: The resource provided arn:aws:states:::aws-sdk:cloudwatchlogs:CreateLogStream is not recognized. The value is not a valid resource ARN, or the resource is not available in this region. at /States/SendTaskSuccess/Resource' (Service: AWSStepFunctions; Status Code: 400; Error Code: InvalidDefinition; Request ID: xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx; Proxy: null)" (RequestToken: xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx, HandlerErrorCode: InvalidRequest)

In this regard, I may submit submitted an another PR that the construct validates inputs or translates to camel cases in StepFunctions props if you use pascal cases for action in props.

#27635

[scanlonp]

Perfect, thanks for the docs links! Looks good.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 6cb06f3
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).