仓库指标
- 星标
- (10,710 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
Describe the feature
The Step Functions SubmitBatchJob task automatically adds a policy to the state machine execution role to allow submitting jobs from any job definition in the account: https://github.com/aws/aws-cdk/blob/3dd0ddafa99db6b18a550e0827ce6b1f799dd552/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/batch/submit-job.ts#L309-L324
Proposed feature: scope down the permission at least to job-definition, i.e. arn:${Partition}:batch:${Region}:${Account}:job-definition/${JobDefinitionName}:*
Use Case
Only assign the least privilege permissions needed, without having to resort to state_machine_role.without_policy_updates()
Proposed Solution
No response
Other Information
I don't really understand what the comment in the configurePolicyStatements method means - was the problem that job definition (with or without revision) could not be used for resource-level permissions, or that revision was required / was not allowed?
According to documentation versions stored by Internet Wayback Machine, AWS has gone somewhat back and forth on this topic, but the current documentation only refers to Actions, resources, and condition keys for AWS Batch. There SubmitJob lists both job-definition and job-definition-revision as optional resource types.
Based on testing with my stacks, specifying the job definition via its name and a wildcard revision is sufficient, i.e., arn:${Partition}:batch:${Region}:${Account}:job-definition/${JobDefinitionName}:* (leaving out :* results in the permissions not working).
Of course the most straightforward way would be to use the full ARNs for the job definitions, but then the permissions would need to be change each time the job definition is modified – maybe not an ideal situation.
Acknowledgements
- I may be able to implement this feature request
- This feature might incur a breaking change
AWS CDK Library version (aws-cdk-lib)
2.238.0
AWS CDK CLI version
2.1110.0 (build 970da46)
Environment details (OS name and version, etc.)
mac OS 26.3