I created an AWS step function using Terraform. For now, the step function has only 1 lambda function for now:
resource "aws_iam_role_policy" "sfn_policy" {
policy = jsonencode(
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "*"
},
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction",
"lambda:InvokeAsync"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [ "states:StartExecution" ],
"Resource": "*"
}
]
}
)
role = aws_iam_role.processing_lambda_role.id
}
resource "aws_sfn_state_machine" "sfn_state_machine_zip_files" {
name = local.zip_files_step_function_name
role_arn = aws_iam_role.processing_lambda_role.arn
definition = <<EOF
{
"Comment": "Process Incoming Zip Files",
"StartAt": "ProcessIncomingZipFiles",
"States": {
"ProcessIncomingZipFiles": {
"Type": "Task",
"Resource": "${aws_lambda_function.process_zip_files_lambda.arn}",
"ResultPath": "$.Output",
"End": true
}
}
}
EOF
}
This is how the role is initially defined:
resource "aws_iam_role" "processing_lambda_role" {
name = local.name
path = "/service-role/"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Principal = { Service = "lambda.amazonaws.com" }
Action = "sts:AssumeRole"
}
]
})
}
Why do I get this error message even though the policies include the AssumeRole policy already. I also tried removing one of the sts:AssumeRole
policies but the error was still there.
"Neither the global service principal states.amazonaws.com, nor the regional one is authorized to assume the provided role."
AWS docs Reference: https://aws.amazon.com/premiumsupport/knowledge-center/step-functions-iam-role-troubleshooting/
CodePudding user response:
The role aws_iam_role.processing_lambda_role
can be only assumed by a lambda function. So, your aws_sfn_state_machine.sfn_state_machine_zip_files
can't assume this role. You have to change the Principal
in the role from:
Principal = { Service = "lambda.amazonaws.com" }
into
Principal = { Service = "states.amazonaws.com" }
You still may have other issues, depending on what you want to do exactly. But your reported error is due to what I mentioned.