Serverless部署报错：无法生成Task状态的IAM策略语句

问题背景 #

使用以下Serverless模板部署Step Functions时：

service: demo-step-function
frameworkVersion: '3'
plugins:
  - serverless-step-functions

package:
  individually: true

provider:
  name: aws
  runtime: nodejs14.x
  memorySize: 256
  stage: ${opt:stage, "dev"}
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - s3:PutObject
        - s3:GetObject
      Resource: !Join ["/", [!GetAtt MainS3Bucket.Arn, "*"]]
    - Effect: Allow
      Action:
        - "dynamodb:*"
      Resource:
        Fn::GetAtt: [MarginTable, Arn]

resources: 
  - ${file(./infra/dynamodb.yml)}
  - ${file(./infra/s3.yml)}

functions:
  # function definitions goes here
  #   handler: global-aggregation.hello

stepFunctions:
  stateMachines:
    MainStateMachine:
      name: my-custom-step-function-main-${self:custom.currentEnv}
      type: EXPRESS
      events:
        - http:
            path: update
            method: POST
            action: StartSyncExecution
            cors: true
            request:
              template:
                application/json: |
                  #set( $body = $util.escapeJavaScript($input.json('$')) )
                  {
                    "input": "$body",
                    "stateMachineArn": "arn:aws:states:${self:provider.region}:${aws:accountId}:stateMachine:my-custom-step-function-main-${self:custom.currentEnv}"
                  }
            response:
              template:
                application/json: |
                  #set($inputRoot = $input.path('$'))
                  $inputRoot.output
      definition:
        StartAt: CreateBatches
        States:
          CreateBatches:
            Type: Task
            Next: RunBatches
            Resource:
              Fn::GetAtt: [CreateBatches, Arn]
          RunBatches:
            Type: Map
            Next: GlobalAggregation
            ItemsPath: $.batch_index
            Parameters:
              batch_id.$: $$.Map.Item.Value
              s3_bucket.$: $.s3_bucket
              s3_key.$: $.s3_key
              rest_input.$: $
            Iterator:
              StartAt: GetBatch
              States:
                GetBatch:
                  Type: Task
                  Next: RunWorkerStateMachine
                  Resource:
                    Fn::GetAtt: [GetBatch, Arn]
                RunWorkerStateMachine:
                  Type: Task
                  End: true
                  Resource: arn:aws:states:::aws-sdk:sfn:startSyncExecution
                  Parameters:
                    Input:
                      batch_data.$: $.batch_data
                    StateMachineArn: arn:aws:states:${aws:region}:${aws:accountId}:stateMachine:my-custom-step-function-worker-${self:custom.currentEnv}
                  ResultSelector:
                    Output.$: States.StringToJson($.Output)
          GlobalAggregation:
            Type: Task
            End: true
            Resource:
              Fn::GetAtt: [GlobalAggregation, Arn]
    WorkerStateMachine:
      name: my-custom-step-function-worker-${self:custom.currentEnv}
      type: EXPRESS
      definition:
        StartAt: PassBatchData
        States:
          PassBatchData:
            Type: Pass
            InputPath: $.batch_data
            Next: ProcessBatch
          ProcessBatch:
            Type: Map
            Next: LocalAggregation
            ItemsPath: $.propertyIds
            Parameters:
              propertyIds.$: $$.Map.Item.Value
              index.$: $$.Map.Item.Index
            Iterator:
              StartAt: MainLambda
              States:
                MainLambda:
                  Type: Task
                  End: true
                  Resource:
                    Fn::GetAtt: [MainLambda, Arn]
          LocalAggregation:
            Type: Task
            End: true
            Resource: 
              Fn::GetAtt: [LocalAggregation, Arn]

执行sls deploy时出现错误：

Cannot generate IAM policy statement for Task state { Type: 'Task',
  End: true,
  Resource: 'arn:aws:states:::aws-sdk:sfn:startSyncExecution',
  Parameters:
   { Input: { 'batch_data.$': '$.batch_data' },
     StateMachineArn: 'arn:aws:states:ap-south-1:244730046330:stateMachine:margin-dynamodb-sf-worker-sm-dev' },
  ResultSelector: { 'Output.$': 'States.StringToJson($.Output)' } }

问题1：错误原因解析 #

这个错误是因为Serverless Step Functions插件无法自动为AWS SDK类型的Task资源生成对应的IAM权限策略。当你使用arn:aws:states:::aws-sdk:sfn:startSyncExecution这种调用其他State Machine的SDK集成Task时，插件无法自动识别需要的states:StartSyncExecution动作以及对应的Worker State Machine资源ARN，导致无法生成合法的IAM策略语句，从而抛出部署错误。

问题2：手动配置IAM权限解决方法 #

要让主State Machine能够调用Worker State Machine，需要手动为其执行角色添加权限，同时修复插件无法自动生成策略的问题，具体步骤如下：

1. 补充自定义环境变量配置 #

首先在配置顶部添加custom字段，确保currentEnv变量能正确解析：

custom:
  currentEnv: ${opt:stage, 'dev'}

2. 为主State Machine添加IAM权限 #

在stepFunctions.stateMachines.MainStateMachine下添加iamRoleStatements，明确允许调用Worker State Machine的权限：

stepFunctions:
  stateMachines:
    MainStateMachine:
      # 原有配置保持不变
      iamRoleStatements:
        - Effect: Allow
          Action:
            - states:StartSyncExecution
          Resource: arn:aws:states:${aws:region}:${aws:accountId}:stateMachine:my-custom-step-function-worker-${self:custom.currentEnv}
      # 原有definition等配置保持不变

3. 重新部署 #

完成上述修改后，执行sls deploy即可正常部署，此时主State Machine的执行角色会包含调用Worker State Machine的权限，插件也不会再抛出无法生成IAM策略的错误。

内容的提问来源于stack exchange，提问作者Tmh