Create SAM StateMachine without providing a role or policy

integration/combination/test_connectors.py

@@ -69,6 +69,7 @@ def test_connector_by_invoking_a_function(self, template_file_path):
 
     @parameterized.expand(
         [
+            ("combination/connector_sfn_to_function_without_policy",),
             ("combination/connector_sfn_to_table_read",),
             ("combination/connector_sfn_to_table_write",),
             ("combination/connector_sfn_to_sqs_write",),

integration/resources/expected/combination/connector_sfn_to_function_without_policy.json

@@ -0,0 +1,22 @@
+[
+  {
+    "LogicalResourceId": "TriggerStateMachineRole",
+    "ResourceType": "AWS::IAM::Role"
+  },
+  {
+    "LogicalResourceId": "MyFunctionRole",
+    "ResourceType": "AWS::IAM::Role"
+  },
+  {
+    "LogicalResourceId": "TriggerStateMachine",
+    "ResourceType": "AWS::StepFunctions::StateMachine"
+  },
+  {
+    "LogicalResourceId": "MyFunction",
+    "ResourceType": "AWS::Lambda::Function"
+  },
+  {
+    "LogicalResourceId": "MyConnectorPolicy",
+    "ResourceType": "AWS::IAM::ManagedPolicy"
+  }
+]

integration/resources/templates/combination/connector_sfn_to_function_without_policy.yaml

@@ -0,0 +1,36 @@
+Resources:
+  TriggerStateMachine:
+    Type: AWS::Serverless::StateMachine
+    Properties:
+      Type: EXPRESS
+      Definition:
+        StartAt: TryDoSomething
+        States:
+          TryDoSomething:
+            Type: Task
+            Resource: !Sub arn:${AWS::Partition}:states:::lambda:invoke
+            Parameters:
+              FunctionName: !Ref MyFunction
+            End: true
+
+  MyFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      Runtime: nodejs14.x
+      Handler: index.handler
+      InlineCode: |
+        exports.handler = async (event) => {
+          console.log(JSON.stringify(event));
+        };
+
+  MyConnector:
+    Type: AWS::Serverless::Connector
+    Properties:
+      Source:
+        Id: TriggerStateMachine
+      Destination:
+        Id: MyFunction
+      Permissions:
+      - Write
+Metadata:
+  SamTransformTest: true

samtranslator/model/stepfunctions/generators.py

@@ -21,6 +21,9 @@ class StateMachineGenerator(object):
     _SAM_VALUE = "SAM"
     _SUBSTITUTION_NAME_TEMPLATE = "definition_substitution_%s"
     _SUBSTITUTION_KEY_TEMPLATE = "${definition_substitution_%s}"
+    SFN_INVALID_PROPERTY_BOTH_ROLE_POLICY = (
+        "Specify either 'Role' or 'Policies' (but not both at the same time) or neither of them"
+    )
 
     def __init__(  # type: ignore[no-untyped-def]
         self,
@@ -129,20 +132,17 @@ def to_cloudformation(self):  # type: ignore[no-untyped-def]
             )
 
         if self.role and self.policies:
-            raise InvalidResourceException(
-                self.logical_id, "Specify either 'Role' or 'Policies' property and not both."
-            )
+            raise InvalidResourceException(self.logical_id, self.SFN_INVALID_PROPERTY_BOTH_ROLE_POLICY)
         if self.role:
             self.state_machine.RoleArn = self.role
-        elif self.policies:
-            if not self.managed_policy_map:
+        else:
+            if self.policies and not self.managed_policy_map:
                 raise Exception("Managed policy map is empty, but should not be.")
-
+            if not self.policies:
+                self.policies = []
             execution_role = self._construct_role()  # type: ignore[no-untyped-call]
             self.state_machine.RoleArn = execution_role.get_runtime_attr("arn")
             resources.append(execution_role)
-        else:
-            raise InvalidResourceException(self.logical_id, "Either 'Role' or 'Policies' property must be specified.")
 
         self.state_machine.StateMachineName = self.name
         self.state_machine.StateMachineType = self.type

tests/model/stepfunctions/test_state_machine_generator.py

@@ -56,12 +56,8 @@ def test_state_machine_no_role_or_policies(self):
         self.kwargs["definition_uri"] = "s3://my-demo-bucket/my_asl_file.asl.json"
         self.kwargs["role"] = None
         self.kwargs["policies"] = None
-        with self.assertRaises(InvalidResourceException) as error:
-            StateMachineGenerator(**self.kwargs).to_cloudformation()
-        self.assertEqual(
-            error.exception.message,
-            "Resource with id [StateMachineId] is invalid. Either 'Role' or 'Policies' property must be specified.",
-        )
+        generated_resources = StateMachineGenerator(**self.kwargs).to_cloudformation()
+        self.assertEqual(generated_resources[1].resource_type, "AWS::IAM::Role")
 
     def test_state_machine_both_role_and_policies(self):
         self.kwargs["definition_uri"] = "s3://my-demo-bucket/my_asl_file.asl.json"
@@ -73,7 +69,8 @@ def test_state_machine_both_role_and_policies(self):
             StateMachineGenerator(**self.kwargs).to_cloudformation()
         self.assertEqual(
             error.exception.message,
-            "Resource with id [StateMachineId] is invalid. Specify either 'Role' or 'Policies' property and not both.",
+            "Resource with id [StateMachineId] is invalid. "
+            + StateMachineGenerator.SFN_INVALID_PROPERTY_BOTH_ROLE_POLICY,
         )
 
     def test_state_machine_invalid_definition_uri_string(self):

tests/translator/input/connector_sfn_to_function_without_policy.yaml

@@ -0,0 +1,36 @@
+Resources:
+  TriggerStateMachine:
+    Type: AWS::Serverless::StateMachine
+    Properties:
+      Type: EXPRESS
+      Definition:
+        StartAt: TryDoSomething
+        States:
+          TryDoSomething:
+            Type: Task
+            Resource: !Sub arn:${AWS::Partition}:states:::lambda:invoke
+            Parameters:
+              FunctionName: !Ref MyFunction
+            End: true
+
+  MyFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      Runtime: nodejs14.x
+      Handler: index.handler
+      InlineCode: |
+        exports.handler = async (event) => {
+          console.log(JSON.stringify(event));
+        };
+
+  MyConnector:
+    Type: AWS::Serverless::Connector
+    Properties:
+      Source:
+        Id: TriggerStateMachine
+      Destination:
+        Id: MyFunction
+      Permissions:
+      - Write
+Metadata:
+  SamTransformTest: true

tests/translator/output/aws-cn/connector_sfn_to_function_without_policy.json

@@ -0,0 +1,175 @@
+{
+  "Metadata": {
+    "SamTransformTest": true
+  },
+  "Resources": {
+    "MyConnectorPolicy": {
+      "Metadata": {
+        "aws:sam:connectors": {
+          "MyConnector": {
+            "Destination": {
+              "Type": "AWS::Serverless::Function"
+            },
+            "Source": {
+              "Type": "AWS::Serverless::StateMachine"
+            }
+          }
+        }
+      },
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "lambda:InvokeAsync",
+                "lambda:InvokeFunction"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "MyFunction",
+                    "Arn"
+                  ]
+                }
+              ]
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "Roles": [
+          {
+            "Ref": "TriggerStateMachineRole"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::ManagedPolicy"
+    },
+    "MyFunction": {
+      "Properties": {
+        "Code": {
+          "ZipFile": "exports.handler = async (event) => {\n  console.log(JSON.stringify(event));\n};\n"
+        },
+        "Handler": "index.handler",
+        "Role": {
+          "Fn::GetAtt": [
+            "MyFunctionRole",
+            "Arn"
+          ]
+        },
+        "Runtime": "nodejs14.x",
+        "Tags": [
+          {
+            "Key": "lambda:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::Lambda::Function"
+    },
+    "MyFunctionRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "lambda.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+        ],
+        "Tags": [
+          {
+            "Key": "lambda:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    },
+    "TriggerStateMachine": {
+      "Properties": {
+        "DefinitionString": {
+          "Fn::Join": [
+            "\n",
+            [
+              "{",
+              "    \"StartAt\": \"TryDoSomething\",",
+              "    \"States\": {",
+              "        \"TryDoSomething\": {",
+              "            \"End\": true,",
+              "            \"Parameters\": {",
+              "                \"FunctionName\": \"${definition_substitution_1}\"",
+              "            },",
+              "            \"Resource\": \"${definition_substitution_2}\",",
+              "            \"Type\": \"Task\"",
+              "        }",
+              "    }",
+              "}"
+            ]
+          ]
+        },
+        "DefinitionSubstitutions": {
+          "definition_substitution_1": {
+            "Ref": "MyFunction"
+          },
+          "definition_substitution_2": {
+            "Fn::Sub": "arn:${AWS::Partition}:states:::lambda:invoke"
+          }
+        },
+        "RoleArn": {
+          "Fn::GetAtt": [
+            "TriggerStateMachineRole",
+            "Arn"
+          ]
+        },
+        "StateMachineType": "EXPRESS",
+        "Tags": [
+          {
+            "Key": "stateMachine:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::StepFunctions::StateMachine"
+    },
+    "TriggerStateMachineRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "states.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [],
+        "Tags": [
+          {
+            "Key": "stateMachine:createdBy",
+            "Value": "SAM"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    }
+  }
+}