(step-functions): (The state machine IAM Role is not authorized to access the Log Destination)

[pete-mcneill]

Describe the bug

Using a custom log group for a while to prefix "vendedlogs" to the log group name for our State Machines.

This has worked previously but this week it has started throwing an error.

Expected Behavior

new sfn.StateMachine(this, "TechnicalData", { stateMachineName: Stack.of(scope).stackName.toLowerCase() + "_TechnicalData", definition: technicalData, tracingEnabled: true, logs: { destination: new LogGroup(this, "TechnicalDataLogGroup", { logGroupName: '/aws/vendedlogs/states/${Stack.of( this ).stackName.toLowerCase()}_TechnicalData', }), level: LogLevel.ALL, }, });

Using this code will generate a State Machine with Log Group.

Current Behavior

Deployment failed with an error:

Resource handler returned message: "The state machine IAM Role is not authorized to access the Log Destination (Service: AWSStepFunctions; Status Code: 400; Error Code: AccessDeniedException; Request ID: 3dde30f8-e3fe-49a5-a424-14c41192ebb0; Proxy: null)" (RequestToken: 43782337-d13f-cbb3-e093-cfe71ed4bcd9, HandlerErrorCode: AccessDenied)

Reproduction Steps

Deploy with a log group that has a logGroupName assigned.

Possible Solution

Tried manually adding the suggested Policy from:
https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.html#cloudwatch-iam-policy

Had success with this but CDK should already be adding this policy on deploy.

Additional Information/Context

No response

CDK CLI Version

2.47.0 (build 3528e3d)

Framework Version

No response

Node.js Version

16

OS

Linux

Language

Typescript

Language Version

No response

Other information

No response

[indrora]

Does this happen when you create the log group first independently, reference it in the state machine properties, and then explicitly grant permission with GrantWrite?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[pete-mcneill]

Adding grant write has fixed it. Looking at what that adds to the IAM role seems to be 2 permissions for creating and putting to a log stream. The link for the correct IAM permissions on AWS docs indicate those should be included along with the others that CDK by default create.

I'll look to create a PR to update the permissions to match the AWS docs

[indrora]

Given that grantWrite is the standard path that should be taken (the CDK doesn't usually hand out permissions, instead going for the grantX pattern), I'm closing this.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.