(aws-stepfunctions-tasks): CallAwsService to allow custom iam policyStatement

[sindhurpillai]

Describe the feature

CallAwsService attaches an IAM permission policy with single action to StepFunction Role.

Use Case

I have Stepfunction that needs to call rekognition service to detect labels in S3 object.
This requires the step function IAM role to have 2 permissions:

1. rekognition:detectLabels
2. s3:GetObject

Currently CallAwsService only adds rekognition:detectLabels and so the stepfunction execution fails

CDK snippet:

new tasks.CallAwsService(this, 'detectLabels',{
          service: 'rekognition',
          action: 'detectLabels',
          parameters: {
            Image: {
              S3Object: {
                Bucket: {bucketName},
                Name: {imageName}
              }
            }
        },
      iamResources:['*']
      })

Proposed Solution

Possible Solutions:

1. Allow user to manually pass 'PolicyStatement' in CallAwsService. If present it will be used to create the role for StateFunction.
2. Depending on service:action, rekognition:detectLabels in this case, add additional service policy permissions.

Other Information

Current work around is to manually grant the additional permissions after defining stepfunction.
Example:
{S3Object}.grantRead({stepFunctionObject})

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

v2

Environment details (OS name and version, etc.)

macOS

[kaizencc]

Looks like CallAwsService exposes a taskPolicies property that is a list of policy statements, but it is protected. The way to get what you need is probably to add a addTaskPolicy() method to CallAwsService that can modify taskPolicies on your behalf.

cc'ing @jogold if you can think of a better way.

[jogold]

The way to get what you need is probably to add a addTaskPolicy() method to CallAwsService that can modify taskPolicies on your behalf.

@kaizencc This or just a iamStatements: iam.PolicyStatement[] prop for "additional IAM statements required by the call"?

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.