aws-sf-executes-as

id: aws-sf-executes-as
emits: ExecutesAs
description: A Step Functions state machine runs every execution as its configured IAM execution role.
match_record:
  resource_type: AWS::StepFunctions::StateMachine
  field: roleArn
where:
- stateMachine.roleArn is non-empty (all valid state machines have an execution role)
emit:
  source_type: GenericCompute
  target_type: MachineIdentity
  source: <Step Functions State Machine (Workflow, modeled as GenericCompute)>
  target: <IAM role from stateMachine.roleArn>
  state: ACTIVE
  conditions:
  - service_state
  permissions: []
  state_logic: ACTIVE when the state machine exists and has a configured execution role (all valid state
    machines have exactly one). CONDITIONAL(service_state) when the state machine is being created but
    the role binding is not yet confirmed. BLOCKED if the state machine is deleted or the role is deleted/disabled.
  derived_from:
  - AWS::StepFunctions::StateMachine.roleArn (DescribeStateMachine)
  false_positive_note: Every Step Functions state machine must have exactly one execution role. The role
    is bound at CreateStateMachine and may be re-bound via UpdateStateMachine. Emit this edge for every
    state machine regardless of trigger configuration or workflow type (Standard vs. Express). State machines
    are modeled as Workflow (Messaging subtype), but for ExecutesAs source constraint we use GenericCompute
    (the closest valid Compute fallback) to satisfy the schema.
  narrative: Step Functions state machine {stateMachine.name} runs every execution as IAM role {role.name}
    (stateMachine.roleArn). Any Task state in the definition makes AWS service calls with {role.name}'s
    credentials.