aws-stepfunction: Failed to create correct IAM role for step function

[jalencato]

Describe the bug

When trying the code here:

submit_training_job = tasks.BatchSubmitJob(
    self, "Sample Training Job",
    job_definition_arn=sfn.JsonPath.string_at("$.trainingJob.jobDefinitionArn"),
    job_name=sfn.JsonPath.string_at("$.trainingJob.jobName"),
    job_queue_arn=sfn.JsonPath.string_at("$.trainingJob.jobQueueArn"),
    result_path="$.trainingJobResult"
)

chain = submit_training_job.next(submit_inference_job)

state_machine = sfn.StateMachine(
    self, "SamplePipeline",
    definition_body=sfn.DefinitionBody.from_chainable(chain)
)

I am just building a step function to submit a batch job with dynamic parameter values by using payload during submit time.

However, when deploying the resource, the code above is trying to create one IAM role with following resources:

Resource                                       Effect      Action                             Principal
$.inferenceJob.jobQueueArn      Allow       Batch:SubmitJob           xxxx

$.inferenceJob.jobQueueArn cannot be retrieved so it will lead to an error. How to handle this case?

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

2.1000.2

Expected Behavior

I assume the role will be deployed correctly. Even if it did not add correct rules, at least it deployed the rules successfully.

Current Behavior

It will throw an error saying:

Refine sentense:        # Do not use $.trainingJob.jobQueue for the job queue because it will 
        # lead to an error when creating associated error in the iam role.

Reproduction Steps

Copy the code above and deploy and it will see the error.

Possible Solution

Anyway we can ban the step function cdk to create the role itself? We can use our own rules this way.

Additional Information/Context

No response

CDK CLI Version

2.1000.2

Framework Version

No response

Node.js Version

21

OS

macos

Language

Python

Language Version

3.9

Other information

No response

[pahud]

The issue is in the configurePolicyStatements() method of the BatchSubmitJob class. Unlike other task implementations, it doesn't check if jobQueueArn is a JsonPath expression. The fix would be to modify this method to check if jobQueueArn is a JsonPath expression, and if so, use a wildcard (*) instead:

aws-cdk/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/batch/submit-job.ts

Line 320 in 9ac3084

this.props.jobQueueArn,