fix: schema state machine Policies

bin/add_transform_test.py

@@ -51,7 +51,7 @@ def add_regional_endpoint_configuration_if_needed(template: Dict[str, Any]) -> D
 def replace_aws_partition(partition: str, file_path: str) -> None:
     template = read_json_file(file_path)
     with open(file_path, "w") as file:
-        updated_template = json.loads(json.dumps(template).replace("arn:aws", f"aws:{partition}"))
+        updated_template = json.loads(json.dumps(template).replace("arn:aws:", f"arn:{partition}:"))
         file.write(json.dumps(updated_template, indent=2))
     print(f"Transform Test output files generated {file_path}")
 
@@ -105,8 +105,10 @@ def copy_input_file_to_transform_test_dir(input_file_path: str, transform_test_i
 
 def verify_input_template(input_file_path: str):  # type: ignore[no-untyped-def]
     if "arn:aws:" in Path(input_file_path).read_text(encoding="utf-8"):
-        print("ERROR: hardcoded partition name detected. Consider replace it with pseudo parameter {AWS::Partition}")
-        sys.exit(1)
+        print(
+            "WARNING: hardcoded partition name detected. Consider replace it with pseudo parameter {AWS::Partition}",
+            file=sys.stderr,
+        )
 
 
 def main() -> None:

samtranslator/schema/aws_serverless_statemachine.py

@@ -4,7 +4,7 @@
 
 from typing_extensions import Literal
 
-from samtranslator.schema.common import PassThrough, BaseModel, SamIntrinsicable, get_prop
+from samtranslator.schema.common import PassThrough, BaseModel, SamIntrinsicable, DictStrAny, get_prop
 
 properties = get_prop("sam-resource-statemachine")
 deadletterconfig = get_prop("sam-property-statemachine-statemachinedeadletterconfig")
@@ -143,7 +143,7 @@ class Properties(BaseModel):
     Logging: Optional[PassThrough] = properties("Logging")
     Name: Optional[PassThrough] = properties("Name")
     PermissionsBoundary: Optional[PassThrough] = properties("PermissionsBoundary")
-    Policies: Optional[Union[str, List[str], Dict[str, Any], List[Dict[str, Any]]]] = properties("Policies")
+    Policies: Optional[Union[str, DictStrAny, List[Union[str, DictStrAny]]]] = properties("Policies")
     Role: Optional[PassThrough] = properties("Role")
     Tags: Optional[Dict[str, Any]] = properties("Tags")
     Tracing: Optional[PassThrough] = properties("Tracing")

samtranslator/schema/common.py

@@ -17,6 +17,8 @@
 # TODO: Get rid of this in favor of proper types
 Unknown = Optional[Any]
 
+DictStrAny = Dict[str, Any]
+
 LenientBaseModel = pydantic.BaseModel
 
 _DOCS = json.loads(Path("samtranslator", "schema", "docs.json").read_bytes())

samtranslator/schema/schema.json

@@ -4851,21 +4851,22 @@
           "markdownDescription": "One or more policies that this state machine's execution role needs\\.  \nThis property accepts a single string or a list of strings\\. The property can be the name of AWS managed AWS Identity and Access Management \\(IAM\\) policies, AWS SAM policy templates, or one or more inline policy documents formatted as a map\\.  \nYou provide either a `Role` or `Policies`\\.  \nIf the `Role` property is set, this property is ignored\\.  \n*Type*: String \\| List \\| Map  \n*Required*: Conditional  \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",
           "anyOf": [
             {
-              "type": "string"
-            },
-            {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
+              "type": "object"
             },
             {
-              "type": "object"
+              "type": "string"
             },
             {
               "type": "array",
               "items": {
-                "type": "object"
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "object"
+                  }
+                ]
               }
             }
           ]

tests/translator/input/schema_validation_1.yaml

@@ -0,0 +1,67 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: lambda-dynamodb
+Transform: AWS::Serverless-2016-10-31
+Resources:
+  StateMachine:
+    Type: AWS::Serverless::StateMachine
+    Properties:
+      Name: !Sub ${AWS::StackName}-StateMachine
+      Definition:
+        StartAt: Start
+        States:
+          Start:
+            Type: Pass
+            Next: TaskState
+          TaskState:
+            Comment: Stackery creates an attachment point for each 'Task' state
+            Type: Task
+            Next: Done
+            Resource: someresource
+            Parameters:
+              FunctionName: ${FunctionArn}
+              Payload.$: $
+          Done:
+            Type: Pass
+            End: true
+      Logging:
+        Level: ALL
+        IncludeExecutionData: true
+        Destinations:
+        - CloudWatchLogsLogGroup:
+            LogGroupArn: !GetAtt StateMachineLogGroup.Arn
+      Policies:
+      - AWSXrayWriteOnlyAccess
+      - Statement:
+        - Effect: Allow
+          Action:
+          - logs:CreateLogDelivery
+          - logs:GetLogDelivery
+          - logs:UpdateLogDelivery
+          - logs:DeleteLogDelivery
+          - logs:ListLogDeliveries
+          - logs:PutResourcePolicy
+          - logs:DescribeResourcePolicies
+          - logs:DescribeLogGroups
+          Resource: '*'
+      - LambdaInvokePolicy:
+          FunctionName: !Ref Function
+      Tracing:
+        Enabled: true
+      Type: STANDARD
+      DefinitionSubstitutions:
+        FunctionArn: !GetAtt Function.Arn
+  Function:
+    Type: AWS::Serverless::Function
+    Properties:
+      FunctionName: !Sub ${AWS::StackName}-Function
+      Description: !Sub
+      - Stack ${StackTagName} Environment ${EnvironmentTagName} Function ${ResourceName}
+      - ResourceName: Function
+      CodeUri: s3://src/Function
+      Handler: index.handler
+      Runtime: nodejs14.x
+      MemorySize: 3008
+      Timeout: 30
+      Tracing: Active
+      Policies:
+      - AWSXrayWriteOnlyAccess

tests/translator/input/schema_validation_2.yaml

@@ -0,0 +1,72 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Transform: AWS::Serverless-2016-10-31
+Description: >
+  A Step Functions Standard Workflow sending payloads to an SQS queue. This pattern
+  will not wait for a callback
+  from SQS
+
+Resources:
+
+##########################################################################
+#   SQS                                                                  #
+##########################################################################
+  MyQueue:
+    Type: AWS::SQS::Queue
+
+##########################################################################
+#   STEP FUNCTION                                                        #
+##########################################################################
+
+  StateMachinetoSQS:
+    Type: AWS::Serverless::StateMachine
+    Properties:
+      Definition:
+        StartAt: SendToMyQueue
+        States:
+          SendToMyQueue:
+            Type: Task
+            Resource: someresource
+            Parameters:
+              QueueUrl: !Ref MyQueue
+              MessageBody.$: $.message
+            End: true
+      Role: !GetAtt [MyStateMachineExecutionRole, Arn]
+
+##########################################################################
+#   Roles                                                               #
+##########################################################################
+
+  MyStateMachineExecutionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+        - Effect: Allow
+          Principal:
+            Service:
+            - !Sub states.${AWS::Region}.amazonaws.com
+          Action: sts:AssumeRole
+      Path: /
+
+
+  SFNToSQS:
+    Type: AWS::Serverless::Connector
+    Properties:
+      Source:
+        Id: StateMachinetoSQS
+      Destination:
+        Id: MyQueue
+      Permissions:
+      - Write
+
+##########################################################################
+#   Outputs                                                              #
+##########################################################################
+Outputs:
+  StateMachinetoSQSArn:
+    Value: !Ref StateMachinetoSQS
+    Description: StateMachinetoSQS Arn
+  MyQueueURL:
+    Value: !Ref MyQueue
+    Description: MyQueue URL