Add PermissionsBoundary support to Step Functions and fix minor issues

Author: Bob Strahan

CHANGELOG.md

@@ -8,7 +8,7 @@ SPDX-License-Identifier: MIT-0
 ### Added
 - **Optional Permissions Boundary Support for Enterprise Deployments**
   - Added `PermissionsBoundaryArn` parameter to all CloudFormation templates for organizations with Service Control Policies (SCPs) requiring permissions boundaries
-  - Comprehensive support for both explicit IAM roles and implicit roles created by AWS SAM functions with `Policies:`
+  - Comprehensive support for both explicit IAM roles and implicit roles created by AWS SAM functions and statemachines`
   - Conditional implementation ensures backward compatibility - when no permissions boundary is provided, roles deploy normally
 
 ## [0.3.8]

patterns/pattern-1/template.yaml

@@ -475,6 +475,7 @@ Resources:
   DocumentProcessingStateMachine:
     Type: AWS::Serverless::StateMachine
     Properties:
+      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
       Name: !Sub "${AWS::StackName}-DocumentProcessingWorkflow"
       DefinitionUri: statemachine/workflow.asl.json
       DefinitionSubstitutions:

patterns/pattern-2/template.yaml

@@ -1315,6 +1315,7 @@ Resources:
   DocumentProcessingStateMachine:
     Type: AWS::Serverless::StateMachine
     Properties:
+      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
       Name: !Sub "${AWS::StackName}-DocumentProcessingWorkflow"
       DefinitionUri: statemachine/workflow.asl.json
       DefinitionSubstitutions:

patterns/pattern-3/template.yaml

@@ -1217,6 +1217,7 @@ Resources:
   DocumentProcessingStateMachine:
     Type: AWS::Serverless::StateMachine
     Properties:
+      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
       Name: !Sub "${AWS::StackName}-DocumentProcessingWorkflow"
       DefinitionUri: statemachine/workflow.asl.json
       DefinitionSubstitutions:

publish.sh

@@ -161,7 +161,7 @@ function calculate_hash() {
 # Calculate directory checksum
 function get_dir_checksum() {
   local dir=$1
-  local dir_checksum=$(find "$dir" -type d \( -name "python" -o -name "node_modules" -o -name "build" -o -name ".aws-sam" -o -name "dist" -o -name "__pycache__" -o -name "*.egg-info" \) -prune -o -type f \( ! -name ".checksum" -a ! -name "*.pyc" \) -exec $STAT_CMD {} \; | sha256sum | awk '{ print $1 }')
+  local dir_checksum=$(find "$dir" -type d \( -name "python" -o -name "node_modules" -o -name "build" -o -name ".aws-sam" -o -name "dist" -o -name "__pycache__" -o ".pytest_cache" -o -name "*.egg-info" \) -prune -o -type f \( ! -name ".checksum" -a ! -name "*.pyc" \) -exec $STAT_CMD {} \; | sha256sum | awk '{ print $1 }')
   local combined_string="$BUCKET $PREFIX_AND_VERSION $REGION $dir_checksum"
   echo -n "$combined_string" | sha256sum | awk '{ print $1 }'
 }