DefinitionS3Location/DefinitionSubstitutions issues

README.md

CF Templates to demonstrate an issue with AWS::StepFunctions::StateMachine DefinitionS3Location/DefinitionSubstitutions

To test deployment you'll need the aws-cli installed and access to an S3 bucket.

Working stack:

• Template: working.yaml
• Deployment: make working S3_BUCKET=<bucket-name>
• Resulting Stack Name: test-stack-working

Invalid StateMachine definition file

• Template: invalid-definition.yaml
• Step Function Definition: invalid-definition-definition.json
• Deployment: make invalid-definition S3_BUCKET=<bucket-name>
• Resulting Stack Name: test-stack-invalid-definition

SCHEMA_VALIDATION_FAILED: Expected value of type Integer at /TimeoutSeconds

• Template: invalid-type.yaml
• Step Function Definition: invalid-type-definition.json
• Deployment: make invalid-type S3_BUCKET=<bucket-name>
• Resulting Stack Name: test-stack-invalid-type

invalid-definition-definition.json

{
  "StartAt": "DummyState",
  "TimeoutSeconds": ${TimeoutSeconds},
  "States": {
    "DummyState": {
      "Type": "Pass",
      "End": true
    }
  }
}

invalid-definition.yaml

Parameters:
  TimeoutSeconds:
    Type: Number
    Default: 60

Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: states.ap-southeast-2.amazonaws.com
      Policies:
        - PolicyName: GetCallerIdentity
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - sts:GetCallerIdentity
                Resource: "*"
                Effect: Allow

  StateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: !Sub ${Role.Arn}
      DefinitionS3Location: invalid-definition-definition.json
      DefinitionSubstitutions:
        TimeoutSeconds: !Ref TimeoutSeconds

invalid-type-definition.json

{
  "StartAt": "DummyState",
  "TimeoutSeconds": "${TimeoutSeconds}",
  "States": {
    "DummyState": {
      "Type": "Pass",
      "End": true
    }
  }
}

invalid-type.yaml

Parameters:
  TimeoutSeconds:
    Type: Number
    Default: 60

Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: states.ap-southeast-2.amazonaws.com
      Policies:
        - PolicyName: GetCallerIdentity
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - sts:GetCallerIdentity
                Resource: "*"
                Effect: Allow

  StateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: !Sub ${Role.Arn}
      DefinitionS3Location: invalid-type-definition.json
      DefinitionSubstitutions:
        TimeoutSeconds: !Ref TimeoutSeconds

Makefile

S3_BUCKET := bucket-name
STACK_BASE_NAME := test-stack

%: %.yaml
	@aws cloudformation package \
		--template-file "$<" \
		--s3-bucket $(S3_BUCKET) \
		--output-template-file deploy.yaml
	@aws cloudformation deploy \
		--template-file deploy.yaml \
		--stack-name "$(STACK_BASE_NAME)-$*" \
		--capabilities CAPABILITY_NAMED_IAM

working.yaml

Parameters:
  TimeoutSeconds:
    Type: Number
    Default: 60

Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: states.ap-southeast-2.amazonaws.com
      Policies:
        - PolicyName: GetCallerIdentity
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - sts:GetCallerIdentity
                Resource: "*"
                Effect: Allow

  StateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: !Sub ${Role.Arn}
      DefinitionString: !Sub >
        {
          "StartAt": "DummyState",
          "TimeoutSeconds": ${TimeoutSeconds},
          "States": {
            "DummyState": {
              "Type": "Pass",
              "End": true
            }
          }
        }