AWS SystemManager Document - Consuming Output of aws:approve

Viewed 9

I am trying to create a runbook where I need to branch and run different steps on approval or rejection. I am using the aws:approve step for this in the AWS SSM document.

Desired Flow of Steps:

SampleStep1 -> ApproveOrReject1

-> (on Approve) ManualAssessmentApproved

(or)

-> (on Deny) ManualAssessmentrejected

The output from aws:approve step when I approve through the console is below

ApprovalStatus: Approved
ApproverDecisions
{
"Approver":"arn:aws:iam::1111111111:role/SampleApproverRole",
"Decision":"Approve",
"ApprovalDecisionTime":"2022-09-24T05:37:37.602922Z",
"Comment":"Sample approve"
}

Problem & Question:

  1. I am not able to branch based on approval. If I approve, I am not able to read the default outputs provided by aws:approve step or also not able to read them into a custom variable. Is it possible to branch on the approval decision or other step ?

  2. Instead of relying on outputs, I tried using the onFailure attribute of aws:approve step. But sadly, this is not working. If I deny the request, the entire automation document goes into a failed state and the failure step is not executed.

mainSteps:
  - name: SampleStep1
    action: 'aws:pause'
    inputs:
      Message: Simple pause message step
    description: Simple Pause
  - name: ApproveOrReject1
    action: 'aws:approve'
    inputs:
      Approvers:
        - 'arn:aws:iam::1111111111:role/SampleApproverRole'
    /*
    Tried putting approval decision into a custom variable
    outputs:
      - Name: CustomApprovalStatus
        Selector: $.ApproverDecisions.Decision
        Type: String
    */
    description: Manual Approval
    onFailure: 'step:ManualAssessmentrejected'
    nextStep: IfApprovedOrNot
  - name: IfApprovedOrNot
    action: 'aws:branch'
    inputs:
      Choices:
        - NextStep: ManualAssessmentApproved
          // "{{ApproveOrReject1.CustomApprovalStatus.Decision}}*
          Variable: '{{ApproveOrReject1.ApproverDecisions["Decision"]}}'
          StringEquals: Approve
      Default: ManualAssessmentrejected
  - name: ManualAssessmentApproved
    action: 'aws:pause'
    inputs:
      Message: 'Status Approved '
    description: Manual pause
    isEnd: true
  - name: ManualAssessmentrejected
    action: 'aws:pause'
    inputs:
      Message: 'Status Rejected '
    description: Manual pause
    isEnd: true
0 Answers
Related