fix(stepfunctions): allow disable x-ray

packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions/test/integ.state-machine-disable-xray.ts

@@ -0,0 +1,25 @@
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as cdk from 'aws-cdk-lib';
+import * as sfn from 'aws-cdk-lib/aws-stepfunctions';
+/*
+ * Stack verification steps:
+ *
+ * -- aws stepfunctions describe-state-machine --state-machine-arn <stack-output> has a status of `ACTIVE`
+ * -- aws iam get-role-policy --role-name <role-name> --policy-name <policy-name> has all actions mapped to respective resources.
+ */
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-stepfunctions-integ');
+
+// const role = new iam.Role(stack, 'Role', {
+// assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+// });
+
+const stateMachine = new sfn.StateMachine(stack, 'StateMachine', {
+ comment: 'a super cool state machine',
+ tracingEnabled: false,
+});
+
+// stateMachine.grantRead(role);
+// stateMachine.grant(role, 'states:SendTaskSuccess');
+
+app.synth();

packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts

@@ -457,7 +457,7 @@ export class StateMachine extends StateMachineBase {
  stateMachineType: props.stateMachineType ?? undefined,
  roleArn: this.role.roleArn,
  loggingConfiguration: props.logs ? this.buildLoggingConfiguration(props.logs) : undefined,
- tracingConfiguration: props.tracingEnabled ? this.buildTracingConfiguration() : undefined,
+ tracingConfiguration: this.buildTracingConfiguration(props.tracingEnabled),
  ...definitionBody.bind(this, this.role, props, graph),
  definitionSubstitutions: props.definitionSubstitutions,
  });
@@ -532,21 +532,27 @@ export class StateMachine extends StateMachineBase {
  };
  }
 
- private buildTracingConfiguration(): CfnStateMachine.TracingConfigurationProperty {
- this.addToRolePolicy(new iam.PolicyStatement({
- // https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources
- // https://docs.aws.amazon.com/step-functions/latest/dg/xray-iam.html
- actions: [
- 'xray:PutTraceSegments',
- 'xray:PutTelemetryRecords',
- 'xray:GetSamplingRules',
- 'xray:GetSamplingTargets',
- ],
- resources: ['*'],
- }));
+ private buildTracingConfiguration(isTracing?: boolean): CfnStateMachine.TracingConfigurationProperty | undefined {
+ if (isTracing === undefined) {
+ return undefined;
+ }
+
+ if (isTracing) {
+ this.addToRolePolicy(new iam.PolicyStatement({
+ // https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources
+ // https://docs.aws.amazon.com/step-functions/latest/dg/xray-iam.html
+ actions: [
+ 'xray:PutTraceSegments',
+ 'xray:PutTelemetryRecords',
+ 'xray:GetSamplingRules',
+ 'xray:GetSamplingTargets',
+ ],
+ resources: ['*'],
+ }));
+ }
 
  return {
- enabled: true,
+ enabled: isTracing,
  };
  }
 }

packages/aws-cdk-lib/aws-stepfunctions/test/state-machine.test.ts

@@ -348,6 +348,25 @@ describe('State Machine', () => {
  });
  });
 
+ test('disable tracing configuration', () => {
+ // GIVEN
+ const stack = new cdk.Stack();
+
+ // WHEN
+ new sfn.StateMachine(stack, 'MyStateMachine', {
+ definitionBody: sfn.DefinitionBody.fromChainable(sfn.Chain.start(new sfn.Pass(stack, 'Pass'))),
+ tracingEnabled: false,
+ });
+
+ // THEN
+ Template.fromStack(stack).hasResourceProperties('AWS::StepFunctions::StateMachine', {
+ DefinitionString: '{"StartAt":"Pass","States":{"Pass":{"Type":"Pass","End":true}}}',
+ TracingConfiguration: {
+ Enabled: false,
+ },
+ });
+ });
+
  test('grant access', () => {
  // GIVEN
  const stack = new cdk.Stack();