AWS SAM StepFunctionsExecutionPolicy 错误：未授权执行：states:StartExecution答案

【问题标题】：AWS SAM StepFunctionsExecutionPolicy error: not authorized to perform: states:StartExecutionAWS SAM StepFunctionsExecutionPolicy 错误：未授权执行：states:StartExecution
【发布时间】：2021-10-29 21:13:29
【问题描述】：

尝试用StepFunctionsExecutionPolicy这样调用nested AWS SFN workflow：

Resources:
  SubProcessStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: statemachine/subproces.asl.json
      DefinitionSubstitutions:
        ...
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref Step1Function
        - LambdaInvokePolicy:
            FunctionName: !Ref Step2Function
        ...

Resources:
  MainProcessStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: statemachine/mainprocess.asl.json
      DefinitionSubstitutions:
        SubProcessStateMachineArn: !GetAtt SubProcessStateMachine.Arn
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref MainStep1Function
        - LambdaInvokePolicy:
            FunctionName: !Ref MainStep2Function
        - DynamoDBWritePolicy:
            TableName: !Ref TransactionTable
        - StepFunctionsExecutionPolicy:
            StateMachineName: !Ref SubProcessStateMachine

导致以下部署错误：

{
  "error": "StepFunctions.AWSStepFunctionsException",
  "cause": "User: arn:aws:sts::123456789:assumed-role/test-stack-MainProcessStateMachineRole-1CH1LCY04D45W/seocvrGPXAHUDBGeYcGgtAlqbcmXAHnC 
   is not authorized to perform: states:StartExecution on resource: arn:aws:states:eu-central-1:123456789:stateMachine:SubProcessStateMachine-kotNR6COw7mh 
  (Service: AWSStepFunctions; Status Code: 400; Error Code: AccessDeniedException; Request ID: 64701c03-207e-423d-94c4-d63e0aa22027; Proxy: null)"
}

CloudFormation 模板有什么问题？

【问题讨论】：

标签： amazon-web-services amazon-cloudformation aws-step-functions aws-sam

【解决方案1】：

发现here SAM 策略模板StepFunctionsExecutionPolicy 实际期望参数StateMachineName 中的状态机名称。

这有点令人困惑，因为其他策略期望一个参数也以后缀 -Name 结尾，但他们期望一个 ARN。

该状态机的正确方法是：

    - StepFunctionsExecutionPolicy:
        StateMachineName: !GetAtt SubProcessStateMachine.Name

【讨论】：