Support EventBridge Service integration

[rohitshetty]

Feature Proposal

Description

Recently AWS Stepfunction started supporting service integration with EventBridge (Announcement here).
Currently if used with serverless-step-functions the permissions are not generated correctly and we get
Cannot generate IAM policy statement for Task state Error, and resulting policy which does Deny for *.

For feature proposals:
Support Generation of proper permissions for this integration

[rohitshetty]

Also, would be very happy to raise a PR if this feature proposal makes sense.

[floydspace]

Hi! 👋

Firstly, thanks for your work on this project! 🙂

Today I used patch-package to patch serverless-step-functions@2.30.0 for the project I'm working on.

Here is the diff that solved my problem:

diff --git a/node_modules/serverless-step-functions/lib/deploy/stepFunctions/compileIamRole.js b/node_modules/serverless-step-functions/lib/deploy/stepFunctions/compileIamRole.js
index 94f25fe..33be8eb 100644
--- a/node_modules/serverless-step-functions/lib/deploy/stepFunctions/compileIamRole.js
+++ b/node_modules/serverless-step-functions/lib/deploy/stepFunctions/compileIamRole.js
@@ -315,6 +315,25 @@ function getSageMakerPermissions(state) {
   ];
 }
 
+function getEventBridgePermissions(state) {
+  const eventBuses = new Set();
+  for (const entry of state.Parameters.Entries) {
+    eventBuses.add(entry.EventBusName || 'default');
+  }
+
+  return [
+    {
+      action: 'events:PutEvents',
+      resource: [...eventBuses].map((eventBus) => ({
+        'Fn::Sub': [
+          'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${eventBus}',
+          { eventBus },
+        ],
+      })),
+    },
+  ];
+}
+
 // if there are multiple permissions with the same action, then collapsed them into one
 // permission instead, and collect the resources into an array
 function consolidatePermissionsByAction(permissions) {
@@ -402,6 +421,10 @@ function getIamPermissions(taskStates) {
       case 'arn:aws:states:::sagemaker:createTransformJob.sync':
         return getSageMakerPermissions(state);
 
+      case 'arn:aws:states:::events:putEvents':
+      case 'arn:aws:states:::events:putEvents.waitForTaskToken':
+        return getEventBridgePermissions(state);
+
       default:
         if (isIntrinsic(state.Resource) || state.Resource.startsWith('arn:aws:lambda')) {
           const trimmedArn = trimAliasFromLambdaArn(state.Resource);

This issue body was partially generated by patch-package.

[horike37]

🎉 This issue has been resolved in version 2.31.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[ameerulislam]

does it work for lambda callback function? I can't get this work

Resource: arn:aws:states:::lambda:invoke.waitForTaskToken

I'm getting this error
Error:
TypeError: state.Resource.match is not a function