Step Functions State Machine
A Step Functions state machine (STANDARD or EXPRESS) with a least-privilege execution role, a managed CloudWatch log group, X-Ray tracing, and encryption at rest - working out of the box from a single name.
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-06-30 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o aws-step-functions-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/aws-step-functions/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle aws-step-functions-1.0.0.sigstore.json \
aws-step-functions-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "0ba390a4316e2ce54b7ad9fb4ff0780c9fddaa21c406ed8a1448c50e77e7ecc0 aws-step-functions-1.0.0.tar.gz" | sha256sum -cUse it from the registry
terraform · opentofumodule "step_functions" {
source = "www.iac-bazaar.com/iac-bazaar/aws-step-functions/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/aws-step-functions?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, live-tested on IaC Bazaar: [Step Functions State Machine](https://www.iac-bazaar.com/catalog/aws-step-functions?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "step_functions" {
source = "www.iac-bazaar.com/iac-bazaar/aws-step-functions/aws"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-step-functions
AWS Step Functions state machine (STANDARD or EXPRESS) with a least-privilege
execution role, an explicitly managed CloudWatch log group, X-Ray tracing, and
encryption at rest. Works with Terraform and OpenTofu (>= 1.6), AWS
provider >= 6.0, < 7.0.
The module stands up end-to-end with a single input (name): it ships a trivial
single Pass-state Amazon States Language (ASL) definition so you get a working,
verifiable state machine out of the box. Supply your own definition (and
policy_json / policy_arns for the services your tasks call) for real
workflows.
Secure defaults:
- Encryption at rest always on — AWS-owned key by default, or your own KMS
key via
encryption_type = "CUSTOMER_MANAGED_KMS_KEY"+kms_key_id. - Execution logging on — a managed CloudWatch log group (30-day retention)
with the role's CloudWatch Logs delivery permissions wired before the state
machine is created (a missing-permissions create failure is the classic
Step Functions footgun). Execution input/output payloads are excluded from
logs by default (
log_include_execution_data = false). - X-Ray tracing on — free until executions emit traces; the created role gets only the X-Ray write permissions it needs.
- Least-privilege role — created automatically (unless you pass
role_arn) with a confused-deputy guard (aws:SourceAccount) on the trust policy and no task permissions until you grant them.
Security notes
- The CloudWatch Logs delivery permissions (
logs:CreateLogDelivery, …) must use a"*"resource — these are account-level delivery APIs that do not support resource scoping. Actions are limited to exactly what Step Functions logging requires. - Keep
log_include_execution_data = falseunless you are certain execution payloads contain no secrets/PII. - For STANDARD workflows holding sensitive data, set
encryption_type = "CUSTOMER_MANAGED_KMS_KEY"to control the key and its rotation/audit trail.
Requirements
- Terraform or OpenTofu
>= 1.6 hashicorp/aws>= 6.0, < 7.0
License
Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
- Inputs
- Outputs
Related modules
aws-app-runner
auto_deployments takes every push to the image tag straight to production with no review, which quietly makes the deployment gate "who can push". Off by default, egress routed through your VPC, and the pull role kept separate from the run role.
aws-amplify-app
Every branch build is served at a public amplifyapp.com URL, and basic auth, the switch that puts a password on it, is off; auto branch creation builds every branch anyone pushes; the repository token lands in state; and environment variables are plaintext. Basic auth on every non-production branch (public by name), auto creation off, exactly one production branch, the custom domain attached.
aws-ecs-fargate-service
Full Fargate stack: cluster, task definition, service with ALB integration, autoscaling, and Cloud Map discovery.
aws-lambda
Lambda with execution role, log group, triggers, aliases, and zip/container packaging handled.
alicloud-workflows
A Serverless Workflow flow and its schedules. role_arn is optional in the API, so a flow without one is created, reads correctly in the console and fails at the first task that touches another service - at execution time. The module refuses that, and turns schedules on, because the API default is off and a disabled schedule shows its cron expression anyway.
gcp-workflows
A Cloud Workflows workflow that runs as a dedicated least-privilege service account instead of the broad Compute Engine default, with inline YAML, deletion protection, and call logging.