Skip to content

fix(stepfunctions-tasks): scope down BatchSubmitJob permissions to specific job definition #37480

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
syukawa-gh wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix(stepfunctions-tasks): scope down BatchSubmitJob permissions to specific job definition #37480

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
0f4bf63
fix(stepfunctions-tasks): scope down BatchSubmitJob permissions to sp…
syukawa-dev Apr 1, 2026
5945c5d
test: add unit test for scoped BatchSubmitJob permissions
syukawa-dev Apr 2, 2026
7ceb05f
fix(stepfunctions-tasks): add Match import to batch submit-job test
syukawa-dev Apr 6, 2026
8bf5981
test: update integ snapshot for scoped BatchSubmitJob permissions
syukawa-dev Apr 7, 2026
f57d1cc
Merge remote-tracking branch 'origin/main' into fix/sfn-batch-submit-…
syukawa-dev Apr 8, 2026
c5ed64f
fix: update integ snapshot after merge from main, remove accidental y…
syukawa-dev Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 3 additions & 9 deletions packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/batch/submit-job.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,17 +308,11 @@ export class BatchSubmitJob extends sfn.TaskStateBase {
}

private configurePolicyStatements(): iam.PolicyStatement[] {
const useWildcard = isJsonPathOrJsonataExpression(this.props.jobQueueArn) || isJsonPathOrJsonataExpression(this.props.jobDefinitionArn);
return [
// Resource level access control for job-definition requires revision which batch does not support yet
// Using the alternative permissions as mentioned here:
// https://docs.aws.amazon.com/batch/latest/userguide/batch-supported-iam-actions-resources.html
new iam.PolicyStatement({
resources: isJsonPathOrJsonataExpression(this.props.jobQueueArn) ? ['*'] : [
Stack.of(this).formatArn({
service: 'batch',
resource: 'job-definition',
resourceName: '*',
}),
resources: useWildcard ? ['*'] : [
this.props.jobDefinitionArn,
this.props.jobQueueArn,
],
actions: ['batch:SubmitJob'],
Expand Down
Loading