AWS Step Function授权错误：IAM角色无法假设自身问题求助

问题场景 #

• 搭建了仅包含SQS:receiveMessage步骤的简易AWS Step Function
• 操作流程：
  1. 向SQS队列X发送消息（已正常送达）
  2. 启动状态机，预期接收该消息，但触发错误

错误信息 #

{
    "id": "5",
    "type": "TaskFailed",
    "details": {
        "cause": "The role arn:aws:iam::1234:role/StepFunctionsSandboxRole is not authorized to assume the task state's role, arn:aws:iam::1234:role/StepFunctionsSandboxRole.",
        "error": "States.TaskFailed",
        "resource": "receiveMessage.waitForTaskToken",
        "resourceType": "aws-sdk:sqs"
    },
    "previous_event_id": "4",
    "event_timestamp": "1682488337384",
    "execution_arn": "arn:aws:states:ap-southeast-2:1234:execution:MyStateMachine:78f95d4d-c6aa-b554-3545-07b8f8507b7d"
}

状态机JSON配置 #

{
  "Comment": "A description of my state machine",
  "StartAt": "ReceiveMessage",
  "States": {
    "ReceiveMessage": {
      "Type": "Task",
      "Parameters": {
        "QueueUrl": "https://sqs.ap-southeast-2.amazonaws.com/1234/workflow-demo-request"
      },
      "Resource": "arn:aws:states:::aws-sdk:sqs:receiveMessage.waitForTaskToken",
      "Credentials": {
        "RoleArn": "arn:aws:iam::1234:role/StepFunctionsSandboxRole"
      },
      "End": true
    }
  },
  "TimeoutSeconds": 10
}

IAM角色StepFunctionsSandboxRole的信任关系 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "states.ap-southeast-2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

问题分析与修复方案 #

核心问题 #

错误的本质是角色权限循环调用的授权缺失：当你在Task步骤中指定Credentials.RoleArn时，Step Functions会先使用状态机的执行角色（也就是这里的StepFunctionsSandboxRole）尝试扮演这个Task指定的角色，但当前信任关系只允许Step Functions服务扮演该角色，没有允许该角色自身进行扮演操作。

另外这里存在冗余配置：你指定的Task角色和状态机执行角色是同一个，完全可以去掉Credentials字段，让Task直接使用状态机的执行角色调用SQS。

修复方案 #

方案1：移除冗余的Credentials配置（推荐）

既然Task要使用的角色和状态机执行角色一致，直接删除状态机JSON里的Credentials节点即可：

{
  "Comment": "A description of my state machine",
  "StartAt": "ReceiveMessage",
  "States": {
    "ReceiveMessage": {
      "Type": "Task",
      "Parameters": {
        "QueueUrl": "https://sqs.ap-southeast-2.amazonaws.com/1234/workflow-demo-request"
      },
      "Resource": "arn:aws:states:::aws-sdk:sqs:receiveMessage.waitForTaskToken",
      "End": true
    }
  },
  "TimeoutSeconds": 10
}

方案2：修改IAM信任关系（若必须保留Task角色配置）

如果一定要在Task中指定角色（即使和执行角色相同），需要修改StepFunctionsSandboxRole的信任关系，允许该角色自身执行sts:AssumeRole操作：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "states.ap-southeast-2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234:role/StepFunctionsSandboxRole"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

同时，必须确保该角色拥有调用sqs:ReceiveMessage的权限，需添加对应的权限策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sqs:ReceiveMessage",
            "Resource": "https://sqs.ap-southeast-2.amazonaws.com/1234/workflow-demo-request"
        }
    ]
}

内容的提问来源于stack exchange，提问作者NullPumpkinException