fix(stepfunctions-tasks): incorrect S3 permissions for AthenaStartQueryExecution

[Sumeet-Badyal]

The changes made by #11045 grant S3 scoped permissions if the optional parameter output location is passed. The output location is not parsed correctly to be attached as a resource. When the output location is correctly parsed, state machines with a valid definition and a valid S3 bucket still fail due to an Unable to verify/create output bucket error. The exact same state machine and S3 bucket pass with wildcard permissions as such the resource for Start Query Execution must be changed to *.

BREAKING CHANGE: type of outputLocation in the experimental Athena StartQueryExecution has been changed to s3.Location from string

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[shivlaks]

@Sumeet-Badyal thanks for submitting the fix - I updated the commit message to indicate the error as per our CONTRIBUTING guide.

the rationale for that is because this will show up in the CHANGELOG under bug fixes and it reads better when it describes the problem that was fixed.

Pull request has been modified.

[shivlaks]

@Sumeet-Badyal I updated the commit description to include the breaking change entry so that it shows up in the changelog.

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 3e1dbc7
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[akiym]

@Sumeet-Badyal Thank you for your PR!
I've tried the changes in this PR, but since objectKey is required, it doesn't seem to work when specifying into directly under the bucket.
Another problem might be that when using CREATE TABLE AS, files are created under tables/ directory of the bucket specified with outputLocation, so we have to specify arn:aws:s3:::my-bucket/* (not including any object keys except wildcard) instead of arn:aws:s3:::my-bucket/foo/*.