Step Function state machines should have logging turned on¶

This controls checks whether an AWS Step Functions state machine has logging turned on. The control fails if a state machine doesn't have logging turned on. If you provide a custom value for the logLevel parameter, the control passes only if the state machine has the specified logging level turned on.

How to fix¶

Attribute logging_configuration[0].level of aws_sfn_state_machine must be non-empty.

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_sfn_state_machine.

resource "aws_sfn_state_machine" "this" {
  definition = jsonencode({ Comment = "A minimal state machine", StartAt = "Pass", States = { Pass = { Type = "Pass", End = true } } })

  logging_configuration {
    include_execution_data = true
    level                  = "ALL"
    log_destination        = "arn:aws:logs:us-east-1:123456789012:log-group:example-log-group:*"
  }

  name     = "pofix-example-state-machine"
  role_arn = "arn:aws:iam::123456789012:role/example-role"
}

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf (CTF) Control: sfn_state_machine_logging_enabled

• AWS Config Managed Rule: STEP_FUNCTIONS_STATE_MACHINE_LOGGING_ENABLED

• Powerpipe Control: aws_compliance.control.sfn_state_machine_logging_enabled