@@ -117,7 +117,7 @@ export interface StateMachineProps {
117117 *
118118 * @default A role is automatically created
119119 */
120- readonly role ?: iam . IRole ;
120+ readonly role ?: iam . IRoleRef & iam . IGrantable ;
121121
122122 /**
123123 * Maximum run time for this state machine
@@ -427,11 +427,6 @@ export class StateMachine extends StateMachineBase {
427427 */
428428 public static readonly PROPERTY_INJECTION_ID : string = 'aws-cdk-lib.aws-stepfunctions.StateMachine' ;
429429
430- /**
431- * Execution role of this state machine
432- */
433- public readonly role : iam . IRole ;
434-
435430 /**
436431 * The name of the state machine
437432 * @attribute
@@ -455,6 +450,11 @@ export class StateMachine extends StateMachineBase {
455450 */
456451 public readonly stateMachineRevisionId : string ;
457452
453+ /**
454+ * Execution role of this state machine
455+ */
456+ private readonly _role : iam . IRoleRef & iam . IGrantable ;
457+
458458 constructor ( scope : Construct , id : string , props : StateMachineProps ) {
459459 super ( scope , id , {
460460 physicalName : props . stateMachineName ,
@@ -476,7 +476,7 @@ export class StateMachine extends StateMachineBase {
476476 this . validateLogOptions ( props . logs ) ;
477477 }
478478
479- this . role = props . role || new iam . Role ( this , 'Role' , {
479+ this . _role = props . role || new iam . Role ( this , 'Role' , {
480480 assumedBy : new iam . ServicePrincipal ( 'states.amazonaws.com' ) ,
481481 } ) ;
482482
@@ -494,7 +494,7 @@ export class StateMachine extends StateMachineBase {
494494 }
495495
496496 if ( props . encryptionConfiguration instanceof CustomerManagedEncryptionConfiguration ) {
497- this . role . addToPrincipalPolicy ( new iam . PolicyStatement ( {
497+ this . _role . grantPrincipal . addToPrincipalPolicy ( new iam . PolicyStatement ( {
498498 effect : iam . Effect . ALLOW ,
499499 actions : [
500500 'kms:Decrypt' , 'kms:GenerateDataKey' ,
@@ -513,7 +513,7 @@ export class StateMachine extends StateMachineBase {
513513 } ) ) ;
514514
515515 if ( props . logs && props . logs . level !== LogLevel . OFF ) {
516- this . role . addToPrincipalPolicy ( new iam . PolicyStatement ( {
516+ this . _role . grantPrincipal . addToPrincipalPolicy ( new iam . PolicyStatement ( {
517517 effect : iam . Effect . ALLOW ,
518518 actions : [
519519 'kms:GenerateDataKey' ,
@@ -540,10 +540,10 @@ export class StateMachine extends StateMachineBase {
540540 const resource = new CfnStateMachine ( this , 'Resource' , {
541541 stateMachineName : this . physicalName ,
542542 stateMachineType : props . stateMachineType ?? undefined ,
543- roleArn : this . role . roleArn ,
543+ roleArn : this . _role . roleRef . roleArn ,
544544 loggingConfiguration : props . logs ? this . buildLoggingConfiguration ( props . logs ) : undefined ,
545545 tracingConfiguration : this . buildTracingConfiguration ( props . tracingEnabled ) ,
546- ...definitionBody . bind ( this , this . role , props , graph ) ,
546+ ...definitionBody . bind ( this , this . _role . grantPrincipal , props , graph ) ,
547547 definitionSubstitutions : props . definitionSubstitutions ,
548548 encryptionConfiguration : buildEncryptionConfiguration ( props . encryptionConfiguration ) ,
549549 } ) ;
@@ -569,15 +569,27 @@ export class StateMachine extends StateMachineBase {
569569 * The principal this state machine is running as
570570 */
571571 public get grantPrincipal ( ) {
572- return this . role . grantPrincipal ;
572+ return this . _role . grantPrincipal ;
573+ }
574+
575+ /**
576+ * Execution role of this state machine
577+ *
578+ * Will throw if the Role object that was given does not implement IRole
579+ */
580+ public get role ( ) : iam . IRole {
581+ if ( ! isIRole ( this . _role ) ) {
582+ throw new ValidationError ( `The role given to this StateMachine is not an IRole, but ${ this . _role . constructor . name } , this ) ;
583+ }
584+ return this . _role ;
573585 }
574586
575587 /**
576588 * Add the given statement to the role's policy
577589 */
578590 @MethodMetadata ( )
579591 public addToRolePolicy ( statement : iam . PolicyStatement ) {
580- this . role . addToPrincipalPolicy ( statement ) ;
592+ this . _role . grantPrincipal . addToPrincipalPolicy ( statement ) ;
581593 }
582594
583595 private validateStateMachineName ( stateMachineName : string ) {
@@ -846,3 +858,9 @@ export class ChainDefinitionBody extends DefinitionBody {
846858 } ;
847859 }
848860}
861+
862+ function isIRole ( x : iam . IRoleRef ) : x is iam . IRole {
863+ const xx = x as iam . IRole ;
864+ return ( ! ! xx . addManagedPolicy && ! ! xx . addToPrincipalPolicy && ! ! xx . assumeRoleAction && ! ! xx . attachInlinePolicy
865+ && ! ! xx . grant && ! ! xx . policyFragment ) ;
866+ }
0 commit comments