What permissions does the 'invoke stepfunction' role (created from cloudwatch events console) have?

user_10581944 0
Viewed 7213

I'm following this article to go through the steps on how to set up a cloudwatch rule in the AWS console to trigger a StepFunction state machine, link:https://blog.shikisoft.com/3-ways-to-schedule-aws-lambda-and-step-functions-state-machines/

One of the steps, in the console it can create a new role to give cloudwatch events permission to trigger statemachine, for some reason I have permission issue when trying this step, can someone try this process and copy the permission/policy of this new role for me? So that I can use it in Terraform definition. Hope this makes sense, thanks.

amazon-cloudwatch-events amazon-cloudwatch aws-step-functions terraform state-machine
2 Answers

This role gives Cloudwatch Events (not rebranded as EventBridge) to assume role as you and then start execution for the state machine.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
             "Action": [ "states:StartExecution" ],
            "Resource": [ "arn:aws:states:*:*:stateMachine:*" ]
        }
     ]
}

This wiki might be helpful https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html#target-permissions-eventbridge

On

for some reason I have permission issue when trying this step

You may not have the permission to either create target or IAM roles. I'd recommend checking the permission of the role you are using in the console.

user_68511210

I suggest you to declare an IAM Role and link it to your "event rule", like in this CloudFormation example, which listens to changes in an S3 bucket:

S3EventRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /
    AssumeRolePolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - events.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: CallStepFunctions
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - states:StartExecution
              Resource:
                - !Ref MainFlow
## Event Rule
S3EventRule:
  Type: AWS::Events::Rule
  Properties:
    Name: your-S3EventRule
    Targets:
      - Id: event_from_S3EventRule
        Arn: your-stepfunctions-arn
        RoleArn: !GetAtt S3EventRole.Arn
    EventPattern:
      source:
        - aws.s3
      detail-type:
        - Object Created
        - Object Deleted
      detail:
        bucket:
          name:
            - your-bucket
user_21972070
Related