diff --git a/lib/deploy/stepFunctions/compileIamRole.js b/lib/deploy/stepFunctions/compileIamRole.js
index bd6f4077..fcb2fa90 100644
--- a/lib/deploy/stepFunctions/compileIamRole.js
+++ b/lib/deploy/stepFunctions/compileIamRole.js
@@ -314,6 +314,7 @@ function getStepFunctionsPermissions(state) {
   let stateMachineArn = state.Mode === 'DISTRIBUTED' ? {
     'Fn::Sub': [
       `arn:aws:states:\${AWS::Region}:\${AWS::AccountId}:stateMachine:${state.StateMachineName}`,
+      {},
     ],
   } : null;
 
diff --git a/lib/deploy/stepFunctions/compileIamRole.test.js b/lib/deploy/stepFunctions/compileIamRole.test.js
index 0084775f..7c75fb83 100644
--- a/lib/deploy/stepFunctions/compileIamRole.test.js
+++ b/lib/deploy/stepFunctions/compileIamRole.test.js
@@ -2338,6 +2338,7 @@ describe('#compileIamRole', () => {
     expect(stepFunctionPermission[0].Resource).to.deep.eq([{
       'Fn::Sub': [
         'arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:myStateMachine',
+        {},
       ],
     },
     ]);