AWS step-functions documentation change
Summary
Restructured documentation to focus on Lambda orchestration workflow. Updated setup instructions, removed detailed IAM policy references, simplified approval step explanation, and added clearer deployment steps.
Security assessment
While the update mentions TaskToken usage (a security feature), it removes explicit IAM policy guidance for Lambda/SQS/SNS. No evidence of addressing vulnerabilities or incidents.
Diff
diff --git a/step-functions/latest/dg/sample-lambda-orchestration.md b/step-functions/latest/dg/sample-lambda-orchestration.md index 0d6c3ec90..60cf02c93 100644 --- a/step-functions/latest/dg/sample-lambda-orchestration.md +++ b/step-functions/latest/dg/sample-lambda-orchestration.md @@ -5 +5 @@ -Step 1: Create the state machineStep 2: Run the state machine +Step 1: Create the state machineStep 2: Run the demo state machine @@ -7,30 +7 @@ Step 1: Create the state machineStep 2: Run the state machine -# Integrate AWS Lambda in a Step Functions state machine with Amazon SQS and Amazon SNS - -This sample project demonstrates how to integrate AWS Lambda functions in Step Functions state machines. - -In this project the Step Functions workflow uses Lambda functions to check a stock price and determine a buy or sell trading recommendation. The user is then provided this recommendation and can choose whether to buy or sell the stock. The result of the trade is returned using an SNS topic. - -The state machine in this sample project integrates with AWS Lambda by passing parameters directly to the AWS resources that are deployed by the project. The project resources include an Amazon SQS queue to manage the request for human approval and an Amazon SNS topic to return the results of the query. - -A Step Functions execution receives a JSON text as input and passes that input to the first state in the workflow. Individual states receive JSON data as input and usually pass JSON data as output to the next state. In this sample project, the output of each step is passed as input to the next step in the workflow. - -To implement a human approval step, you typically pause the workflow execution until a task token is returned. In this project the workflow passes a message to an Amazon SQS queue. The message contains a task token and the output returned by the preceding step. This message triggers a Lambda function that's defined to handle callback functionality. The Lambda function is invoked with the payload of the message. The workflow execution pauses until it receives the task token back from a [`SendTaskSuccess`](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html) API call. For more information about task tokens, see [Wait for a Callback with Task Token](./connect-to-resource.html#connect-wait-token). - -For more information about Step Functions service integrations, see [Integrating services with Step Functions](./integrate-services.html). - -For more information about IAM policies for Lambda, Amazon SQS, and Amazon SNS, see the following guides: - - * [IAM policies for calling AWS Lambda](./connect-lambda.html#lambda-iam) - - * [IAM policies for calling Amazon SQS ](./connect-sqs.html#sqs-iam) - - * [IAM policies for calling Amazon SNS](./connect-sns.html#sns-iam) - - - - -###### Note - - * This sample project may incur charges. - - * For new AWS users, a free usage tier is available. This tier offers free services below a certain level of usage. For more information about AWS costs and the free tier, see [Pricing](https://aws.amazon.com/step-functions/pricing). +# Orchestrate AWS Lambda functions with Step Functions @@ -37,0 +9 @@ For more information about IAM policies for Lambda, Amazon SQS, and Amazon SNS, +The **Orchestrate Lambda functions** template uses several Lambda functions in a sample stock trading workflow. One function checks a stock price, then a human is prompted to choose to buy or sell the stock. A choice state selects the next function based on the `recommended_type` variable to complete the purchase or sale. After either function finishes, the result of the trade is then published before reaching the end of the workflow. @@ -38,0 +11 @@ For more information about IAM policies for Lambda, Amazon SQS, and Amazon SNS, +To implement the human approval step, the workflow execution pauses until a unique TaskToken is returned. In this project, the workflow passes a message with the task token to an Amazon SQS queue. The message triggers another Lambda function that's configured to handle a callback based on the payload of the message. The workflow pauses until it receives the task token back from a [`SendTaskSuccess`](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html) API call. For more information about task tokens, see [Wait for a Callback with Task Token](./connect-to-resource.html#connect-wait-token). @@ -39,0 +13 @@ For more information about IAM policies for Lambda, Amazon SQS, and Amazon SNS, + @@ -45,12 +19 @@ For more information about IAM policies for Lambda, Amazon SQS, and Amazon SNS, - 2. Find and choose the starter template you want to work with. Choose **Next** to continue. - - 3. Choose **Run a demo** to create a read-only and ready-to-deploy workflow, or choose **Build on it** to create an editable state machine definition that you can build on and later deploy. - - 4. Choose **Use template** to continue with your selection. - - - - -Next steps depend on your previous choice: - - 1. **Run a demo** – You can review the state machine before you create a **read-only** project with resources deployed by AWS CloudFormation to your AWS account. + 2. Choose **Create from template** and find the related starter template. Choose **Next** to continue. @@ -58,7 +21 @@ Next steps depend on your previous choice: -You can view the state machine definition, and when you are ready, choose **Deploy and run** to deploy the project and create the resources. - -Deploying can take up to 10 minutes to create resources and permissions. You can use the Stack ID link to monitor progress in AWS CloudFormation. - -After deploy completes, you should see your new state machine in the console. - - 2. **Build on it** – You can review and edit the workflow definition. You might need to set values for placeholders in the sample project before attemping to run your custom workflow. + 3. Choose how to use the template: @@ -65,0 +23 @@ After deploy completes, you should see your new state machine in the console. + 1. **Run a demo** – creates a read-only state machine. After review, you can create the workflow and all related resources. @@ -66,0 +25 @@ After deploy completes, you should see your new state machine in the console. + 2. **Build on it** – provides an editable workflow definition that you can review, customize, and deploy with your own resources. (Related resources, such as functions or queues, will **not** be created automatically.) @@ -67,0 +27 @@ After deploy completes, you should see your new state machine in the console. + 4. Choose **Use template** to continue with your selection. @@ -71 +31 @@ After deploy completes, you should see your new state machine in the console. - _Standard charges might apply for services deployed to your account._ + _Standard charges apply for services deployed to your account._ @@ -73 +32,0 @@ After deploy completes, you should see your new state machine in the console. -## Step 2: Run the state machine @@ -75 +33,0 @@ After deploy completes, you should see your new state machine in the console. - 1. On the **State machines** page, choose your sample project. @@ -77 +34,0 @@ After deploy completes, you should see your new state machine in the console. - 2. On the sample project page, choose **Start execution**. @@ -79 +36 @@ After deploy completes, you should see your new state machine in the console. - 3. In the **Start execution** dialog box, do the following: +## Step 2: Run the demo state machine @@ -81 +38 @@ After deploy completes, you should see your new state machine in the console. - 1. (Optional) Enter a custom execution name to override the generated default. +If you chose the **Run a demo** option, all related resources will be deployed and ready to run. If you chose the **Build on it** option, you might need to set placeholder values and create additional resources before you can run your custom workflow. @@ -83 +40 @@ After deploy completes, you should see your new state machine in the console. -###### Non-ASCII names and logging + 1. Choose **Deploy and run**. @@ -85 +42 @@ After deploy completes, you should see your new state machine in the console. -Step Functions accepts names for state machines, executions, activities, and labels that contain non-ASCII characters. Because such characters will not work with Amazon CloudWatch, we recommend using only ASCII characters so you can track metrics in CloudWatch. + 2. Wait for the AWS CloudFormation stack to deploy. This can take up to 10 minutes. @@ -87,5 +44 @@ Step Functions accepts names for state machines, executions, activities, and lab - 2. (Optional) In the **Input** box, enter input values as JSON. You can skip this step if you are running a demo. - - 3. Choose **Start execution**. - -The Step Functions console will direct you to an _Execution Details_ page where you can choose states in the **Graph view** to explore related information in the [Step details](./concepts-view-execution-details.html#exec-details-intf-step-details) pane. + 3. After the **Start execution** option appears, review the **Input** and choose **Start execution**. @@ -98 +51,3 @@ The Step Functions console will direct you to an _Execution Details_ page where -You should now have either a running demo or a state machine definition that you can customize. +You should now have a running demo of your state machine. You can choose states in the **Graph view** to review input, output, variables, definition, and events. + +For more information about Step Functions service integrations, see [Integrating services with Step Functions](./integrate-services.html).