我正在尝试创建一个可以调用另一个状态机的状态机。我尝试使用以下方法获取ARN。但是,这将返回错误Arn不是有效的属性,正在创建该堆栈。
ParentStateMachine:
Type: "AWS::StepFunctions::StateMachine"
Properties:
StateMachineName: !Sub "ParentStateMachine"
DefinitionString:
Fn::Sub:
- |-
{
"Comment": "...",
"StartAt": "State1",
"States": {
"State1": {
"Type": "Task",
"Resource": "arn:aws:states:::states:startExecution.sync",
"Parameters": {
"StateMachineArn": "${ChildStateMachineArn}",
"Input": {
"StatePayload": {
"datasetDate.$": "$.datasetDate"
},
"AWS_STEP_FUNCTIONS_STARTED_BY_EXECUTION_ID.$": "$$.Execution.Id"
}
},
"End": true
}
}
}
- {
ChildStateMachineArn:
Fn::GetAtt:
- ChildStateMachine
- Arn
}
RoleArn:
Fn::GetAtt:
- StatesExecutionRole
- Arn
我还尝试使用此字符串生成ARN。
arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:ChildStateMachine
但是,这给了错误
Failed to call Step Functions for request: 'com.amazonaws.services.stepfunctions.model.CreateStateMachineRequest'. (Service: null; Status Code: 500; Error Code: null; Request ID: null)
我能够使用云形成来创建其他类型的状态机。只有当我试图创建一个执行子工作流程的工具时,它才起作用。当我转到云路径时,CreateStateMachineEvent的错误代码为“访问被拒绝”。我已授予管理员对该角色的访问权限。有没有人遇到这个问题并找到解决方案?
我遇到了同样的问题。在将“ states:StartExecution”权限授予ParentStateMachine之后,我能够进行修复。
为父级StatMachine的StatesExecutionRole创建一个内联策略,并使用ChildStateMachineName添加如下所示的内容。它应该可以解决问题。
- PolicyDocument:
Version: '2012-10-17'
Statement:
-
Effect: Allow
Action:
- states:StartExecution
Resource: !GetAtt ChildStateMachine.Arn