Aws step function deployment log access issue

Question

I am running into Some permissions issue i am not able to figure out.

The step function deployment fails because of error:

Error: AccessDeniedException: The state machine IAM Role is not authorized to access the Log Destination 10:12:19 status code: 400, request id: ff46f8c0-fcc8-4190-ba6a-13f5ab617c78 10:12:19
10:12:19 on step_function.tf line 1, in resource "aws_sfn_state_machine" "oss_integration_data_process_sf": 10:12:19 1: resource "aws_sfn_state_machine" "os_int_data_process_sf" {

funny thing is, it only happens to one lambda while all lambdas have same prefix and we have step function give permissions as: { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:AssociateKmsKey", "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups" ], "Resource": [ "arn:aws:logs:us-east-1:XXXX:log-group:*/*" ], "Effect": "Allow" } i can run the lambda after deployment and see CW log stream with lambda name is getting created.

user_11652090 · Answer

I faced the same error The state machine IAM Role is not authorized to access the Log Destination when using a cloudformation template, but the actual problem was that the YAML field CloudWatchLogsLogGroup was misconfigured.

So I updated it to use the syntax below and it all worked.

  StateMachine:
    Type: AWS::Serverless::StateMachine
    DependsOn: 
      - LogGroup
      - CustomRole
    Properties:
      Name: StateMachine
      Role: !Sub arn:aws:iam::${AWS::AccountId}:role/CustomRole
      Logging:
        Destinations:
          - CloudWatchLogsLogGroup: 
              LogGroupArn: !GetAtt LogGroup.Arn          
        IncludeExecutionData: true
        Level: ALL

Nonetheless, I think the AWS documentation is very confusing on this topic.

user_504877 · Answer

I had the same issue and resolved by updating policies for the Role as described here: https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.html

Normally PutLogEvents, CreateLogStream should be enough for resources like Lambda but apprantly Step Function need other log policies as well.

Aws step function deployment log access issue

2 Answers