grantTaskResponse in Step Functions specifies the State Machine as the resource when task responses only support the all resources wildcard (*)

[aidandeno]

StateMachine#grantTaskResponse seems to be broken, but this comes down to the fact that the states:SendTask* actions are not supposed to be scoped to a specific resource and instead should specify *.

The issue is here: https://github.com/aws/aws-cdk/blob/v2.83.0/packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts#L245

When you use the visual policy editor, you see a message "Selected actions only support the all resources wildcard(*)" when these actions are selected.

To this end, when I replace this:

myStateMachine.grantTaskResponse(myRole)

with this:

Grant.addToPrincipal({
  grantee: myRole,
  actions: ['states:SendTask*'],
  resourceArns: ['*'],
})

the exception messages from my activity workers about lacking permissions for SendTaskHeartBeat go away and everything is happy again.