Provide more grant APIs for the StateMachine construct

Like StateMachine#grantStartExecution, be able to have a StateMachine#grantDescribeExecution

Use Case

In order to improve readability and have a standard way of give permissions over a StateMachine As a devops I’ll want to give permission to describe an execution to an aws resource

Proposed Solution

First create an executionArn, like the stateMachineArn, this because the arn are different when giving permissions. for example: arn:aws:states:us-east-1:1234567890:stateMachine:StateMachineExample arn:aws:states:us-east-1:1234567890:execution:StateMachineExample

Then create a method grantDescribeExecution and use the executionArn.

something like this:

abstract class StateMachineBase extends Resource implements IStateMachine {
    // ...
    public abstract readonly stateMachineArn: string;
    public abstract readonly executionArn: string;
    /**
     * Grant the given identity permissions to start an execution of this state
     * machine.
     */
    public grantStartExecution(identity: iam.IGrantable): iam.Grant {
        return iam.Grant.addToPrincipal({
            grantee: identity,
            actions: ['states:StartExecution'],
            resourceArns: [this.stateMachineArn]
        });
    }
    public grantDescribeExecution(identity: iam.IGrantable): iam.Grant {
        return iam.Grant.addToPrincipal({
            grantee: identity,
            actions: ['states:DescribeExecution'],
            resourceArns: [this.executioArn, "*"] // this I'm not sure because could be a better way?     
            // the idea is to have something like this arn:aws:states:us-east-1:123456:execution:StateMachineExample:*
        });
    }
}

and

export class StateMachine extends StateMachineBase {
    /**
     * The ARN of the state machine
     */
    public readonly stateMachineArn: string;
    /**
     * The ARN of the state machine execution
     */
    public abstract readonly executionArn: string;
    constructor(scope: Construct, id: string, props: StateMachineProps) {
        // ...
        this.stateMachineName = this.getResourceNameAttribute(resource.attrName);
        this.stateMachineArn = this.getResourceArnAttribute(resource.ref, {
          service: 'states',
          resource: 'stateMachine',
          resourceName: this.physicalName,
          sep: ':',
        });

        this.executionArn = this.getResourceArnAttribute(resource.ref, {
          service: 'states',
          resource: 'execution',
          resourceName: this.physicalName,
          sep: ':',
        });
    }

On the other hand and not totally related, this could be done also:

    public grantSendTaskSuccess(identity: iam.IGrantable): iam.Grant {
        return iam.Grant.addToPrincipal({
            grantee: identity,
            actions: ['states:SendTaskSuccess'],
            resourceArns: [this.stateMachineArn]
        });
    }
    public grantSendTaskFailure(identity: iam.IGrantable): iam.Grant {
        return iam.Grant.addToPrincipal({
            grantee: identity,
            actions: ['states:SendTaskFailure'],
            resourceArns: [this.stateMachineArn]
        });
    }

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[nija-at]

I would re-shape these APIs to be -

1. a grantRead() which provides Describe, List and a number of other read operations,
2. a grantTaskResponse() (or something similar) that provides both SendTaskSuccess, SendTaskFailure and SendTaskHeartbeat that allow for the task to report its status, and
3. a general grant() API that takes a list of string IAM action names that can be used by the user for fine-grained control.

[seansullivan]

Perhaps I’m missing something here, but the grantTaskResponse() does not appropriately set the permission on a Lambda function as it has an UnknownPrincipal as stated here

Upon deploying CDK project, I am met with the warning message:

Add statement to this resource's role: {"action":["states:SendTaskSuccess"],"notAction":[],"principal":{},"notPrincipal":{},"resource":[{"Ref":"myStateMachineStackMyStateMachineA67BBFB7"}],"notResource":[],"condition":{},"effect":"Allow"}

Of course, if I add the permission directly on the Lambda’s role as a policy statement, everything works fine:

new PolicyStatement({
        effect: Effect.ALLOW,
        actions: ['states:SendTask*'],
        resources: [`arn:aws:states:${this.region}:${this.account}:stateMachine:*`]
})

Is the intent of these APIs to allow to use as such for a Lambda function?

const myLambdaFunction = Function.fromFunctionArn(myLambdaFunctionArn);

myStateMachine.grantTaskResponse(myLambdaFunction);

For further context, this Lambda lives outside of StepFunctions and is used for manual task response via API Gateway.