I am trying to create a runbook where I need to branch and run different steps on approval or rejection. I am using the aws:approve step for this in the AWS SSM document.
Desired Flow of Steps:
SampleStep1 -> ApproveOrReject1
-> (on Approve) ManualAssessmentApproved
(or)
-> (on Deny) ManualAssessmentrejected
The output from aws:approve step when I approve through the console is below
ApprovalStatus: Approved
ApproverDecisions
{
"Approver":"arn:aws:iam::1111111111:role/SampleApproverRole",
"Decision":"Approve",
"ApprovalDecisionTime":"2022-09-24T05:37:37.602922Z",
"Comment":"Sample approve"
}
Problem & Question:
I am not able to branch based on approval. If I approve, I am not able to read the default outputs provided by aws:approve step or also not able to read them into a custom variable. Is it possible to branch on the approval decision or other step ?
Instead of relying on outputs, I tried using the
onFailureattribute of aws:approve step. But sadly, this is not working. If I deny the request, the entire automation document goes into a failed state and the failure step is not executed.
mainSteps:
- name: SampleStep1
action: 'aws:pause'
inputs:
Message: Simple pause message step
description: Simple Pause
- name: ApproveOrReject1
action: 'aws:approve'
inputs:
Approvers:
- 'arn:aws:iam::1111111111:role/SampleApproverRole'
/*
Tried putting approval decision into a custom variable
outputs:
- Name: CustomApprovalStatus
Selector: $.ApproverDecisions.Decision
Type: String
*/
description: Manual Approval
onFailure: 'step:ManualAssessmentrejected'
nextStep: IfApprovedOrNot
- name: IfApprovedOrNot
action: 'aws:branch'
inputs:
Choices:
- NextStep: ManualAssessmentApproved
// "{{ApproveOrReject1.CustomApprovalStatus.Decision}}*
Variable: '{{ApproveOrReject1.ApproverDecisions["Decision"]}}'
StringEquals: Approve
Default: ManualAssessmentrejected
- name: ManualAssessmentApproved
action: 'aws:pause'
inputs:
Message: 'Status Approved '
description: Manual pause
isEnd: true
- name: ManualAssessmentrejected
action: 'aws:pause'
inputs:
Message: 'Status Rejected '
description: Manual pause
isEnd: true