feat: Add support to Fn::GetAtt X.Y when looking up IAM role in serve…

samtranslator/model/intrinsics.py

@@ -217,9 +217,15 @@ def get_logical_id_from_intrinsic(input: Any) -> Optional[str]:
     if isinstance(v, str):
         return v
 
-    # !GetAtt <logical-id>.<attribute>
+    # Fn::GetAtt: [<logical-id>, <attribute>]
     v = input.get("Fn::GetAtt")
     if isinstance(v, list) and len(v) == 2 and isinstance(v[0], str):
         return v[0]
 
+    # Fn::GetAtt: <logical-id>.<attribute>
+    if isinstance(v, str):
+        tokens = v.split(".")
+        if len(tokens) == 2:
+            return tokens[0]
+
     return None

tests/test_intrinsics.py

@@ -86,6 +86,7 @@ def test_validate_intrinsic_if_items_invalid(self):
     @parameterized.expand(
         [
             ({"Fn::GetAtt": ["Foo", "Bar"]}, "Foo"),
+            ({"Fn::GetAtt": "Foo.Bar"}, "Foo"),
             ({"Ref": "Foo"}, "Foo"),
         ]
     )
@@ -95,12 +96,13 @@ def test_get_logical_id_from_intrinsic_success(self, input, expected):
     @parameterized.expand(
         [
             (None,),
-            ("Foo"),
+            ("Foo",),
             ({"Ref": True}),
             ({"Fn::GetAtt": "Foo"}),
             ({"Fn::GetAtt": ["Foo"]}),
             ({"Fn::GetAtt": [42, "Arn"]}),
             ({"Fn::If": ["Foo", "Bar"]}),
+            ({"Fn::GetAtt": "Foo.Bar.WhatEverThisIs"},),
         ]
     )
     def test_get_logical_id_from_intrinsic_error(self, input):

tests/translator/input/connector_sfn_to_sfn.yaml

@@ -8,7 +8,7 @@ Resources:
         States:
           TryDoSomething:
             Type: Task
-            Resource: arn:aws:states:::states:startExecution.sync:2
+            Resource: !Sub arn:${AWS::Partition}:states:::states:startExecution.sync:2
             Parameters:
               StateMachineArn: !Ref MyStateMachine
             End: True
@@ -39,3 +39,59 @@ Resources:
       Permissions:
         - Read
         - Write
+
+  StateMachineRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Action: [ 'sts:AssumeRole' ]
+            Effect: Allow
+            Principal:
+              Service: [ states.amazonaws.com ]
+
+  TriggerStateMachineWithoutRole:
+    Type: AWS::Serverless::StateMachine
+    Properties:
+      Name: TriggerStateMachineWithoutRole
+      Role: !GetAtt StateMachineRole.Arn
+      Definition:
+        StartAt: Success
+        States:
+          Success:
+            Type: Succeed
+
+  TriggerStateMachineWithoutRole2:
+    Type: AWS::Serverless::StateMachine
+    Properties:
+      Name: TriggerStateMachineWithoutRole
+      Role:
+        Fn::GetAtt: StateMachineRole.Arn
+      Definition:
+        StartAt: Success
+        States:
+          Success:
+            Type: Succeed
+
+  MyConnectorProvidingRole1:
+    Type: AWS::Serverless::Connector
+    Properties:
+      Source:
+        Id: TriggerStateMachineWithoutRole
+      Destination:
+        Id: MyStateMachine
+      Permissions:
+        - Write
+        - Read
+
+  MyConnectorProvidingRole2:
+    Type: AWS::Serverless::Connector
+    Properties:
+      Source:
+        Id: TriggerStateMachineWithoutRole2
+      Destination:
+        Id: MyStateMachine
+      Permissions:
+        - Write
+        - Read