无服务器：无法为任务状态生成 IAM 策略语句

Question

我的无服务器模板如下：

service: demo-step-function
frameworkVersion: '3'
plugins:
  - serverless-step-functions

package:
  individually: true

provider:
  name: aws
  runtime: nodejs14.x
  memorySize: 256
  stage: ${opt:stage, "dev"}
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - s3:PutObject
        - s3:GetObject
      Resource: !Join ["/", [!GetAtt MainS3Bucket.Arn, "*"]]
    - Effect: Allow
      Action:
        - "dynamodb:*"
      Resource:
        Fn::GetAtt: [MarginTable, Arn]

resources: 
  - ${file(./infra/dynamodb.yml)}
  - ${file(./infra/s3.yml)}


functions:
  # function definitions goes here
  #   handler: global-aggregation.hello

stepFunctions:
  stateMachines:
    MainStateMachine:
      name: my-custom-step-function-main-${self:custom.currentEnv}
      type: EXPRESS
      events:
        - http:
            path: update
            method: POST
            action: StartSyncExecution
            cors: true
            request:
              template:
                application/json: |
                  #set( $body = $util.escapeJavaScript($input.json('$')) )
                  {
                    "input": "$body",
                    "stateMachineArn": "arn:aws:states:${self:provider.region}:${aws:accountId}:stateMachine:my-custom-step-function-main-${self:custom.currentEnv}"
                  }
            response:
              template:
                application/json: |
                  #set($inputRoot = $input.path('$'))
                  $inputRoot.output
      definition:
        StartAt: CreateBatches
        States:
          CreateBatches:
            Type: Task
            Next: RunBatches
            Resource:
              Fn::GetAtt: [CreateBatches, Arn]
          RunBatches:
            Type: Map
            Next: GlobalAggregation
            ItemsPath: $.batch_index
            Parameters:
              batch_id.$: $$.Map.Item.Value
              s3_bucket.$: $.s3_bucket
              s3_key.$: $.s3_key
              rest_input.$: $
            Iterator:
              StartAt: GetBatch
              States:
                GetBatch:
                  Type: Task
                  Next: RunWorkerStateMachine
                  Resource:
                    Fn::GetAtt: [GetBatch, Arn]
                RunWorkerStateMachine:
                  Type: Task
                  End: true
                  Resource: arn:aws:states:::aws-sdk:sfn:startSyncExecution
                  Parameters:
                    Input:
                      batch_data.$: $.batch_data
                    StateMachineArn: arn:aws:states:${aws:region}:${aws:accountId}:stateMachine:my-custom-step-function-worker-${self:custom.currentEnv}
                  ResultSelector:
                    Output.$: States.StringToJson($.Output)
          GlobalAggregation:
            Type: Task
            End: true
            Resource:
              Fn::GetAtt: [GlobalAggregation, Arn]
    WorkerStateMachine:
      name: my-custom-step-function-worker-${self:custom.currentEnv}
      type: EXPRESS
      definition:
        StartAt: PassBatchData
        States:
          PassBatchData:
            Type: Pass
            InputPath: $.batch_data
            Next: ProcessBatch
          ProcessBatch:
            Type: Map
            Next: LocalAggregation
            ItemsPath: $.propertyIds
            Parameters:
              propertyIds.$: $$.Map.Item.Value
              index.$: $$.Map.Item.Index
            Iterator:
              StartAt: MainLambda
              States:
                MainLambda:
                  Type: Task
                  End: true
                  Resource:
                    Fn::GetAtt: [MainLambda, Arn]
          LocalAggregation:
            Type: Task
            End: true
            Resource: 
              Fn::GetAtt: [LocalAggregation, Arn]

当我运行 sls deploy 时出现以下错误：

Cannot generate IAM policy statement for Task state { Type: 'Task',
  End: true,
  Resource: 'arn:aws:states:::aws-sdk:sfn:startSyncExecution',
  Parameters:
   { Input: { 'batch_data.$': '$.batch_data' },
     StateMachineArn: 'arn:aws:states:ap-south-1:244730046330:stateMachine:margin-dynamodb-sf-worker-sm-dev' },
  ResultSelector: { 'Output.$': 'States.StringToJson($.Output)' } }

1. 我不确定为什么会抛出上述错误。
2. 我无法为主步骤函数生成 Iam 角色以允许访问辅助步骤函数。我必须手动创建一个 IAM 角色才能从主 stepfunction 访问 worker stepfunction。

   帮我解决上面两个错误

Answer 1

看起来好像在无服务器步骤函数插件中没有处理 aws-sdk:sfn:startSyncExecution 类型的资源，定义为 here。

可以向插件添加处理，例如this pull request。