Using aws sfn with s3-bucket

Question

Pulumi · Accepted Answer

Certainly! In this scenario, we'll create a simple AWS Step Functions (SFN) State Machine that interacts with an Amazon S3 bucket using Pulumi with TypeScript. I'll guide you through the process and explain each part of the code.

AWS Step Functions allow you to create and run a series of tasks, modeled as a state machine. Each state in the machine represents a task that can do things like running an AWS Lambda function, launching an AWS Batch job, or even interacting with Amazon S3. For today, we'll keep it simplified to a scenario where our state machine checks for the existence of a specific object in an S3 bucket.

To achieve this, we'll complete the following steps in the program:

1. Create an S3 bucket: We'll define an S3 bucket resource that our state machine can interact with.
2. Define an IAM role for Step Functions: This IAM role will allow the SFN state machine to invoke actions on AWS services, specifically S3 in this case.
3. Define a Step Functions state machine: We'll create the actual state machine with its definition, which includes states to interact with the S3 bucket.

Here's the Pulumi program that accomplishes the tasks outlined above:

```typescript
import * as aws from "@pulumi/aws";

// Step 1: Create an S3 bucket
const bucket = new aws.s3.Bucket("myBucket", {
  // Updating this property to make the bucket publicly accessible
  // This is generally not recommended for production code!
  acl: "public-read",
});

// Step 2: Define an IAM role for Step Functions that allows access to S3
const role = new aws.iam.Role("sfnRole", {
  assumeRolePolicy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [{
      Action: "sts:AssumeRole",
      Effect: "Allow",
      Principal: {
        Service: "states.amazonaws.com",
      },
    }],
  }),
});

const policy = new aws.iam.RolePolicy("sfnPolicy", {
  role: role.id,
  policy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [{
      Action: [
        "s3:ListBucket",
        "s3:GetObject",
      ],
      Resource: [
        bucket.arn, // Bucket ARN
        `${bucket.arn}/*`, // All objects within bucket
      ],
      Effect: "Allow",
    }],
  }),
});

// Step 3: Define a Step Functions state machine
const stateMachine = new aws.sfn.StateMachine("myStateMachine", {
  roleArn: role.arn,
  definition: JSON.stringify({
    Comment: "A Hello World example of the Amazon States Language using an AWS Lambda Function",
    StartAt: "CheckS3",
    States: {
      CheckS3: {
        Type: "Task",
        Resource: "arn:aws:states:::s3:getObject",
        Parameters: {
          Bucket: bucket.id,
          Key: "HelloWorld.txt",
        },
        End: true,
      },
    },
  }),
});

// We expose the S3 bucket's name and the SFN state machine's ARN as stack outputs
export const bucketName = bucket.id;
export const stateMachineArn = stateMachine.id;
```

### Explanation

1. We import the necessary Pulumi AWS package that contains the classes for interacting with various AWS services.

2. We create an S3 bucket named `myBucket` with public-read access control list (ACL). For production applications, you'd typically specify finer-grained permissions.

3. We define an IAM Role for Step Functions with trust policy allowing the Step Function service to assume this role (`states.amazonaws.com`).

4. We declare a role policy granting our state machine the ability to list the bucket and get objects from the S3 bucket we created. Here we reference the bucket ARN directly and use `${bucket.arn}/*` to denote all objects inside the bucket.

5. We define a Step Functions state machine that uses the IAM role we created with a single task state. This state is defined to utilize the `s3:getObject` service integration which mimics the action of retrieving an object with the specified key from the designated S3 bucket. In this example, we are looking for an object with the key `HelloWorld.txt`.

6. Finally, we export the S3 bucket's name and the state machine's ARN as stack outputs, so they can be easily referenced or used in other operations, such as CI/CD pipelines or monitoring setups.

When executed, this Pulumi program will provision these AWS resources in your account, and you will get a state machine that, when started, checks an object in the specified S3 bucket.

Keep in mind that this is a basic example to illustrate the concept. For a production workload, you need to consider security best practices, including limiting the permissions to the minimum required, handling state transitions and errors in the state machine, and encrypting sensitive data.