aws-stepfunctions-tasks: CallAwsService for elasticloadbalancingv2 produces invalid IAM role policies

[tomykaira]

Describe the bug

sfn.StateMachine with tasks.CallAwsService helps to setup an IAM role by scanning the task definition.

When the task definition contains CallAwsService with service: 'elasticloadbalancingv2',
the state machine's IAM role has a policy like this:

"Action": "elasticloadbalancingv2:describeTargetGroups",

However, elasticloadbalancingv2 is invalid in IAM actions. It should be elasticloadbalancing.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

It produces IAM role policy like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "elasticloadbalancing:describeTargetGroups",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Current Behavior

It produces IAM role policy like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "elasticloadbalancingv2:describeTargetGroups",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Reproduction Steps

Include this state machine declaration in a stack.

    new sfn.StateMachine(this, 'BugReportSample1', {
      definition: new tasks.CallAwsService(this, 'GetTargetGroups', {
        service: 'elasticloadbalancingv2',
        action: 'describeTargetGroups',
        resultPath: '$.targetGroups',
        iamResources: ['*'],
      }),
    });

Possible Solution

Add some conversion here: https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/aws-sdk/call-aws-service.ts#L116

Additional Information/Context

No response

CDK CLI Version

2.172.0 (build 0f666c5)

Framework Version

No response

Node.js Version

v20.12.2

OS

Fedora release 38 (Thirty Eight)

Language

TypeScript

Language Version

5.6.3

Other information

No response

[nmussy]

Thanks for the very clear bug report, I've opened a PR to address this issue 👍

[pahud]

Thank you @tomykaira and @nmussy for your immediate PR support!!

[pahud]

Just checked the IAM console. When selecting ELBv2 describeTargetGroups I actually get this policy.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": "elasticloadbalancing:DescribeTargetGroups",
			"Resource": "*"
		}
	]
}

[nmussy]

Yeah that's the expected result, and what my PR generates: https://github.com/aws/aws-cdk/pull/32419/files#diff-c366bafc63a0d3f2bf3e8ec4c85c8b48bffce5352ce7cd5d77f460d34372160bR404-R406

The statement prior to the change is elasticloadbalancingv2:DescribeTargetGroups

EDIT: Unless you're talking about the difference in casing, which shouldn't matter (docs):

The prefix and the action name are case insensitive

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.