Lambda State Machine should depend on its IAM Policies

[mshober]

The policies created with a @aws-cdk/aws-stepfunctions.StateMachine have no references/dependencies to them. Therefore, when a stack deletion is initiated, the policies might be deleted first, then the state machine.

In my situation, I am using the provider framework from @aws-cdk/custom-resources, which uses a State Machine to handle custom resource creation/deletion. When trying to delete a custom resource (via a stack deletion), the stack deletes the state machine's IAM policy before the state machine is finished deleting the custom resource. The state machine then loses its permission to invoke its associated lambda functions, and the custom resource remains in a DELETE_IN_PROGRESS state until a stack timeout occurs.

Solution

See the fix in the code below. This is also how @aws-cdk/aws-lambda.Function handles its IAM dependencies.

@aws-cdk/aws-stepfunctions/lib/state-machine.js

class StateMachine extends StateMachineBase {
    constructor(scope, id, props) {
        super(scope, id, {
            physicalName: props.stateMachineName,
        });
        this.role = props.role || new iam.Role(this, 'Role', {
            assumedBy: new iam.ServicePrincipal('states.amazonaws.com'),
        });
        const graph = new state_graph_1.StateGraph(props.definition.startState, `State Machine ${id} definition`);
        graph.timeout = props.timeout;
        const resource = new stepfunctions_generated_1.CfnStateMachine(this, 'Resource', {
            stateMachineName: this.physicalName,
            roleArn: this.role.roleArn,
            definitionString: core_1.Stack.of(this).toJsonString(graph.toGraphJson()),
        });
        for (const statement of graph.policyStatements) {
            this.addToRolePolicy(statement);
        }

        // This will add a dependency to its policy as well as the role
        resource.node.addDependency(this.role); // <- Add This

        this.stateMachineName = this.getResourceNameAttribute(resource.attrName);
        this.stateMachineArn = this.getResourceArnAttribute(resource.ref, {
            service: 'states',
            resource: 'stateMachine',
            resourceName: this.physicalName,
            sep: ':',
        });
    }
...

Environment

• Environment
• CLI Version : 1.18
• Framework Version: 1.18
• Language : Typescript

This is 🐛 Bug Report

[rix0rrr]

Sounds like a great fix! Would you mind turning this into a Pull Request?

[mshober]

Hi @rix0rrr, I've submitted a pull request!