15

I'm writing the terraform for creating an IAM role for AWS StepFunctions. What should be the value for Principal in assume_role_policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "stepfunctions.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}

I'm getting the error

Error: Error creating IAM Role my_utility_sfn: MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"stepfunctions.amazonaws.com"

Neeraj
  • 1,769
  • 3
  • 24
  • 41

3 Answers3

21

The AWS documentation for service endpoints should hold the answer.

Looks like it is states.<region>.amazonaws.com

GreenyMcDuff
  • 3,292
  • 7
  • 34
  • 66
1

The principal is states.<region>.amazonaws.com :

https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-lambda-state-machine-cloudformation.html#lambda-state-machine-cfn-create-role

gileri
  • 662
  • 8
  • 16
0

In short, the correct Service Principal for AWS Step Functions is:

states.amazonaws.com
Heder Dyego
  • 60
  • 1
  • 5
  • 1
    Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Oct 21 '22 at 11:06