feat(stepfunctions-tasks): add optional role property to EvaluateExpressionProps

packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions-tasks/test/integ.evaluate-expression.ts

@@ -2,6 +2,7 @@ import { App, Stack, StackProps } from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import { Construct } from 'constructs';
 import * as sfn from 'aws-cdk-lib/aws-stepfunctions';
+import * as iam from 'aws-cdk-lib/aws-iam';
 import * as cdk from 'aws-cdk-lib';
 import * as tasks from 'aws-cdk-lib/aws-stepfunctions-tasks';
 import { STANDARD_NODEJS_RUNTIME } from '../../config';
@@ -14,9 +15,19 @@ import { STANDARD_NODEJS_RUNTIME } from '../../config';
  */
 
 class TestStack extends Stack {
+
+ readonly statemachine: sfn.StateMachine;
+
  constructor(scope: Construct, id: string, props?: StackProps) {
  super(scope, id, props);
 
+ const customRole = new iam.Role(this, 'Role', {
+ assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+ });
+ customRole.addManagedPolicy(
+ iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
+ );
+
  const sum = new tasks.EvaluateExpression(this, 'Sum', {
  expression: '$.a + $.b',
  resultPath: '$.c',
@@ -32,9 +43,10 @@ class TestStack extends Stack {
  expression: '(new Date()).toUTCString()',
  resultPath: '$.now',
  runtime: STANDARD_NODEJS_RUNTIME,
+ role: customRole,
  });
 
- const statemachine = new sfn.StateMachine(this, 'StateMachine', {
+ this.statemachine = new sfn.StateMachine(this, 'StateMachine', {
  definition: sum
  .next(multiply)
  .next(
@@ -46,16 +58,39 @@ class TestStack extends Stack {
  });
 
  new cdk.CfnOutput(this, 'StateMachineARN', {
- value: statemachine.stateMachineArn,
+ value: this.statemachine.stateMachineArn,
  });
  }
 }
 
 const app = new App();
 
-new integ.IntegTest(app, 'EvaluateExpressionInteg', {
- testCases: [new TestStack(app, 'cdk-sfn-evaluate-expression-integ')],
+const testStack = new TestStack(app, 'cdk-sfn-evaluate-expression-integ');
+
+const testCase = new integ.IntegTest(app, 'EvaluateExpressionInteg', {
+ testCases: [testStack],
  diffAssets: true,
 });
 
+const start = testCase.assertions.awsApiCall('StepFunctions', 'startExecution', {
+ stateMachineArn: testStack.statemachine.stateMachineArn,
+ name: '309d2593-a5a2-4ea5-b401-f778ef06467c',
+ input: '{ "a": 3, "b": 4 }',
+});
+
+// describe the results of the execution
+testCase.assertions
+ .awsApiCall(
+ 'StepFunctions',
+ 'describeExecution',
+ {
+ executionArn: start.getAttString('executionArn'),
+ })
+ .expect(integ.ExpectedResult.objectLike({
+ status: 'SUCCEEDED',
+ }))
+ .waitForAssertions({
+ totalTimeout: cdk.Duration.minutes(3),
+ });
+
 app.synth();

packages/aws-cdk-lib/aws-stepfunctions-tasks/README.md

@@ -127,9 +127,10 @@ new sfn.StateMachine(this, 'StateMachine', {
 });
 ```
 
-The `EvaluateExpression` supports a `runtime` prop to specify the Lambda
-runtime to use to evaluate the expression. Currently, only runtimes
-of the Node.js family are supported.
+The `EvaluateExpression` supports a `runtime` prop to specify the Lambda runtime to use to evaluate
+the expression. Currently, only runtimes of the Node.js family are supported.
+
+To bring your own custom execution role for the Lambda function use the `role` property.
 
 ## API Gateway
 

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/evaluate-expression.ts

@@ -22,6 +22,13 @@ export interface EvaluateExpressionProps extends sfn.TaskStateBaseProps {
  * @default - the latest Lambda node runtime available in your region.
  */
  readonly runtime?: lambda.Runtime;
+
+ /**
+ * This is the role that will be assumed by the function upon execution.
+ *
+ * @default - a role will be automatically created
+ */
+ readonly role?: iam.IRole;
 }
 
 /**
@@ -58,7 +65,7 @@ export class EvaluateExpression extends sfn.TaskStateBase {
  constructor(scope: Construct, id: string, private readonly props: EvaluateExpressionProps) {
  super(scope, id, props);
 
- this.evalFn = createEvalFn(this.props.runtime, this);
+ this.evalFn = createEvalFn(this.props, this);
 
  this.taskPolicies = [
  new iam.PolicyStatement({
@@ -96,7 +103,7 @@ export class EvaluateExpression extends sfn.TaskStateBase {
  }
 }
 
-function createEvalFn(runtime: lambda.Runtime | undefined, scope: Construct) {
+function createEvalFn(props: EvaluateExpressionProps, scope: Construct) {
  const NO_RUNTIME = Symbol.for('no-runtime');
  const lambdaPurpose = 'Eval';
 
@@ -112,14 +119,19 @@ function createEvalFn(runtime: lambda.Runtime | undefined, scope: Construct) {
  [NO_RUNTIME]: '41256dc5-4457-4273-8ed9-17bc818694e5',
  };
 
- const uuid = nodeJsGuids[runtime?.name ?? NO_RUNTIME];
+ let uuid = nodeJsGuids[props.runtime?.name ?? NO_RUNTIME];
  if (!uuid) {
- throw new Error(`The runtime ${runtime?.name} is currently not supported.`);
+ throw new Error(`The runtime ${props.runtime?.name} is currently not supported.`);
+ }
+
+ if (props.role) {
+ uuid += props.role.node.addr;
  }
 
  return new EvalNodejsSingletonFunction(scope, 'EvalFunction', {
  uuid,
  lambdaPurpose,
  runtime,
+ role: props.role,
  });
 }

packages/aws-cdk-lib/aws-stepfunctions-tasks/test/evaluate-expression.test.ts

@@ -1,4 +1,5 @@
 import { Template } from '../../assertions';
+import * as iam from '../../aws-iam';
 import { Runtime, RuntimeFamily } from '../../aws-lambda';
 import * as sfn from '../../aws-stepfunctions';
 import { Stack } from '../../core';
@@ -111,3 +112,47 @@ test('With Node.js 20.x', () => {
  Runtime: 'nodejs20.x',
  });
 });
+
+test('With created role', () => {
+ // WHEN
+ const role = new iam.Role(stack, 'Role', {
+ assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+ roleName: 'role-for-test',
+ });
+
+ const taskWithoutRole = new tasks.EvaluateExpression(stack, 'TaskWithoutRole', {
+ expression: '$.a + $.b',
+ });
+
+ const taskWithRole = new tasks.EvaluateExpression(stack, 'TaskWithRole', {
+ expression: '$.a + $.b',
+ role,
+ });
+
+ new sfn.StateMachine(stack, 'SM', {
+ definitionBody: sfn.DefinitionBody.fromChainable(taskWithRole.next(taskWithoutRole)),
+ });
+
+ // THEN
+ Template.fromStack(stack).resourceCountIs('AWS::Lambda::Function', 2);
+
+ Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Function', {
+ Runtime: 'nodejs18.x',
+ Role: {
+ 'Fn::GetAtt': ['Role1ABCC5F0', 'Arn'],
+ },
+ });
+
+ Template.fromStack(stack).resourcePropertiesCountIs('AWS::IAM::Role', {
+ AssumeRolePolicyDocument: {
+ Statement: [
+ {
+ Principal: {
+ Service: 'lambda.amazonaws.com',
+ },
+ },
+ ],
+ },
+ },
+ 2);
+});