含aws:sourceArn条件的Step Functions角色信任策略授权失败求助

状态机执行失败，报错信息如下：

The principal states.amazonaws.com is not authorized to assume the provided role. (role: arn:aws:iam::[masked]:role/my-state-machine-role)

该状态机关联的IAM角色信任策略已明确允许states.amazonaws.com主体，策略内容如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "states.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:states:<regionName>:<AccountId>:stateMachine:<stateMachineNamePrefix>*"
                }
            }
        }
    ]
}

注：<regionName>、<accountId>和<stateMachineNamePrefix>为实际配置的占位符，该策略是参考AWS官方文档中防止跨服务混淆代理的方案配置。

移除信任策略中的Condition节点后，状态机执行恢复正常。已联系AWS官方支持，确认此为AWS侧的bug。

内容的提问来源于stack exchange，提问作者Paweł Rubin