AWS step-functions documentation change

Service: step-functions · 2025-04-11 · Documentation medium

File: step-functions/latest/dg/connect-batch.md

Summary

Expanded AWS Batch integration example with additional parameters and security guidance about IAM policies and tag-based access control

Security assessment

Added documentation about using tags for fine-grained access control in IAM policies, which constitutes security best practice guidance

Diff

diff --git a/step-functions/latest/dg/connect-batch.md b/step-functions/latest/dg/connect-batch.md
index 990f09b95..15a0f64ad 100644
--- a//step-functions/latest/dg/connect-batch.md
+++ b//step-functions/latest/dg/connect-batch.md
@@ -22 +22 @@ Note that there are no optimizations for the [Request Response](./connect-to-res
-The following includes a `Task` state that submits an AWS Batch job and waits for it to complete.
+The following shows an example `Task` state that submits an AWS Batch job and waits for it to complete. Many of the arguments shown are optional.
@@ -25,4 +25 @@ The following includes a `Task` state that submits an AWS Batch job and waits fo
-    {
-      "StartAt": "BATCH_JOB",
-      "States": {
-        "BATCH_JOB": {
+    "Submit Batch Job": {
@@ -31,5 +28,7 @@ The following includes a `Task` state that submits an AWS Batch job and waits fo
-          "Parameters": {
-            "JobDefinition": "preprocessing",
-            "JobName": "PreprocessingBatchJob",
-            "JobQueue": "SecondaryQueue",
-            "Parameters.$": "$.batchjob.parameters",
+        "Arguments": {
+            "JobName": "BATCH_NAME",
+            "JobQueue": "BATCH_QUEUE_ARN",
+            "JobDefinition": "BATCH_JOB_DEFINITION_ARN",
+            "ArrayProperties": {
+            "Size": 10
+            },
@@ -42,0 +42,5 @@ The following includes a `Task` state that submits an AWS Batch job and waits fo
+            },
+            "DependsOn": [
+            {
+                "JobId": "myJobId",
+                "Type": "SEQUENTIAL"
@@ -43,0 +48,11 @@ The following includes a `Task` state that submits an AWS Batch job and waits fo
+            ],
+            "PropagateTags": true,
+            "Parameters": {
+            "Key1": "value1",
+            "Key2": 100
+            },
+            "RetryStrategy": {
+            "Attempts": 1
+            },
+            "Tags": {
+            "Tag": "TAG"
@@ -45 +60,2 @@ The following includes a `Task` state that submits an AWS Batch job and waits fo
-          "End": true
+            "Timeout": {
+            "AttemptDurationSeconds": 10
@@ -91 +107,5 @@ The following example templates show how AWS Step Functions generates IAM polici
-Because AWS Batch provides partial support for resource-level access control, you must use `"Resource": "*"`.
+Because job ids for `SubmitJob` and `TerminateJob` are generated and therefore only known at runtime, you cannot create a policy that restricts access based on a specific resource. 
+
+###### Tip for fine grained access
+
+To add fine grained access to `SubmitJob` and `TerminateJob`, consider using tags for jobs and creating a policy that limits access based on your tags. In addition, the job queue, definition, and consumable resources can be restricted for `SubmitJob` using known resources.