feat(policy-templates): add new policy for allowing step functions ex…

[ljacobsson]

…ecutions

Description of changes:
Added policy template allowing states:StartExecution on a Step Functions state machine

Description of how you validated changes:
I have used the policy statement in my own stacks.

Checklist:

• Write/update tests
• make pr passes
• Update documentation

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov-io]

Codecov Report

❗ No coverage uploaded for pull request base (develop@166304b). Click here to learn what that means.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             develop     #904   +/-   ##
==========================================
  Coverage           ?   94.65%           
==========================================
  Files              ?       69           
  Lines              ?     3011           
  Branches           ?      559           
==========================================
  Hits               ?     2850           
  Misses             ?       85           
  Partials           ?       76

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 166304b...a6da17f. Read the comment docs.

[jlhood]

Thanks so much for this PR! This will definitely be a useful policy template to have. I've added a few comments. Also, I changed this PR to be based on the develop branch (latest code). Please rebase your branch to the latest develop so it can be merged.

[jlhood]

Looks great! Thanks for adding this policy. 😊

[ericallam]

I think it'd be nice to include the states:DescribeExecution action in this policy template. The use case being the lambda that starts an execution will receive an executionArn in the response and should be able to call describeExecution on that arn. The Resource could be structured using the State Machine name like so:

arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:${StateMachineName}:*