diff --git a/samtranslator/model/eventsources/scheduler.py b/samtranslator/model/eventsources/scheduler.py index 220006bc40..23eef91b69 100644 --- a/samtranslator/model/eventsources/scheduler.py +++ b/samtranslator/model/eventsources/scheduler.py @@ -122,7 +122,11 @@ def to_cloudformation(self, **kwargs: dict[str, Any]) -> list[Resource]: execution_role_arn: Union[str, dict[str, Any]] = self.RoleArn # type: ignore[assignment] if not execution_role_arn: execution_role = self._construct_execution_role( - target, target_type, passthrough_resource_attributes, dlq_queue_arn, self.PermissionsBoundary + cast(Resource, kwargs.get("state_machine", target)), + target_type, + passthrough_resource_attributes, + dlq_queue_arn, + self.PermissionsBoundary, ) resources.append(execution_role) execution_role_arn = execution_role.get_runtime_attr("arn") diff --git a/samtranslator/model/stepfunctions/events.py b/samtranslator/model/stepfunctions/events.py index b85ab9f87b..5870a7cbc1 100644 --- a/samtranslator/model/stepfunctions/events.py +++ b/samtranslator/model/stepfunctions/events.py @@ -146,7 +146,7 @@ def to_cloudformation(self, resource, **kwargs): # type: ignore[no-untyped-def] role: Union[IAMRole, str, dict[str, Any]] if self.RoleArn is None: - role = self._construct_role(resource, permissions_boundary, prefix=None) + role = self._construct_role(kwargs.get("state_machine", resource), permissions_boundary, prefix=None) resources.append(role) else: role = self.RoleArn @@ -263,7 +263,7 @@ def to_cloudformation(self, resource, **kwargs): # type: ignore[no-untyped-def] resources.append(events_rule) role = self._construct_role( - resource, + kwargs.get("state_machine", resource), permissions_boundary, prefix=None, ) @@ -375,7 +375,7 @@ def to_cloudformation(self, resource, **kwargs): # type: ignore[no-untyped-def] # Convert to lower case so that user can specify either GET or get self.Method = self.Method.lower() - role = self._construct_role(resource, permissions_boundary, prefix=None) + role = self._construct_role(kwargs.get("state_machine", resource), permissions_boundary, prefix=None) resources.append(role) explicit_api = kwargs["explicit_api"] diff --git a/samtranslator/model/stepfunctions/generators.py b/samtranslator/model/stepfunctions/generators.py index 6ed1ca301c..8f561450c8 100644 --- a/samtranslator/model/stepfunctions/generators.py +++ b/samtranslator/model/stepfunctions/generators.py @@ -341,6 +341,8 @@ def _generate_event_resources(self) -> list[dict[str, Any]]: kwargs = { "intrinsics_resolver": self.intrinsics_resolver, "permissions_boundary": self.permissions_boundary, + # Step Functions authorizes alias invocations against the underlying state machine. + "state_machine": self.state_machine, } try: eventsource = self.event_resolver.resolve_resource_type(event_dict).from_dict( diff --git a/tests/model/eventsources/test_schedulev2_event_source.py b/tests/model/eventsources/test_schedulev2_event_source.py index 88b5389b3f..29466061c4 100644 --- a/tests/model/eventsources/test_schedulev2_event_source.py +++ b/tests/model/eventsources/test_schedulev2_event_source.py @@ -7,6 +7,7 @@ from samtranslator.model.exceptions import InvalidEventException from samtranslator.model.lambda_ import LambdaFunction from samtranslator.model.scheduler import SchedulerSchedule +from samtranslator.model.stepfunctions.resources import StepFunctionsStateMachine, StepFunctionsStateMachineAlias class ScheduleV2EventSourceInSamFunction(TestCase): @@ -169,6 +170,15 @@ def test_to_cloudformation_with_dlq_generated_with_intrinsic_function_custom_log class ScheduleV2EventSourceInSamStateMachine(TestCase): + def test_alias_target_uses_state_machine_permissions(self) -> None: + state_machine = StepFunctionsStateMachine("Machine") + alias = StepFunctionsStateMachineAlias("MachineAliaslive") + + resources = self.schedule_event_source.to_cloudformation(resource=alias, state_machine=state_machine) + + self.assertEqual(resources[0].Target["Arn"], {"Ref": "MachineAliaslive"}) + self.assertEqual(resources[1].Policies[0]["PolicyDocument"]["Statement"][0]["Resource"], {"Ref": "Machine"}) + def setUp(self): self.logical_id = "ScheduleEvent" diff --git a/tests/model/stepfunctions/test_state_machine_generator.py b/tests/model/stepfunctions/test_state_machine_generator.py index 968708152e..4833f92300 100644 --- a/tests/model/stepfunctions/test_state_machine_generator.py +++ b/tests/model/stepfunctions/test_state_machine_generator.py @@ -164,6 +164,10 @@ def test_state_machine_with_alias_as_event_source_target(self): state_machine_generator._generate_managed_traffic_shifting_resources() generated_event_resources = state_machine_generator._generate_event_resources() self.assertEqual(generated_event_resources[0].Targets[0]["Arn"], {"Ref": "StateMachineIdAliaslive"}) + self.assertEqual( + generated_event_resources[1].Policies[0]["PolicyDocument"]["Statement"][0]["Resource"], + {"Ref": "StateMachineId"}, + ) def test_state_machine_with_alias_as_event_source_target_requires_alias(self): self.kwargs["definition_uri"] = "s3://mybucket/myASLfile" diff --git a/tests/translator/output/aws-cn/state_machine_with_events_and_alias.json b/tests/translator/output/aws-cn/state_machine_with_events_and_alias.json index 60f4052a5c..865682ece2 100644 --- a/tests/translator/output/aws-cn/state_machine_with_events_and_alias.json +++ b/tests/translator/output/aws-cn/state_machine_with_events_and_alias.json @@ -70,7 +70,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -133,7 +133,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -193,7 +193,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -254,7 +254,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -312,7 +312,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] diff --git a/tests/translator/output/aws-us-gov/state_machine_with_events_and_alias.json b/tests/translator/output/aws-us-gov/state_machine_with_events_and_alias.json index 60f4052a5c..865682ece2 100644 --- a/tests/translator/output/aws-us-gov/state_machine_with_events_and_alias.json +++ b/tests/translator/output/aws-us-gov/state_machine_with_events_and_alias.json @@ -70,7 +70,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -133,7 +133,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -193,7 +193,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -254,7 +254,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -312,7 +312,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] diff --git a/tests/translator/output/state_machine_with_events_and_alias.json b/tests/translator/output/state_machine_with_events_and_alias.json index 1f4567f899..f00e986a49 100644 --- a/tests/translator/output/state_machine_with_events_and_alias.json +++ b/tests/translator/output/state_machine_with_events_and_alias.json @@ -70,7 +70,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -133,7 +133,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -193,7 +193,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -254,7 +254,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ] @@ -312,7 +312,7 @@ "Action": "states:StartExecution", "Effect": "Allow", "Resource": { - "Ref": "MyStateMachineAliastest" + "Ref": "MyStateMachine" } } ]