Step Functions state machine must have logging enabled

Medium AWS General aws-stepfunctions-statemachine-diagnostics

Applies to

AWS::StepFunctions::StateMachine

What CGPulse checks

A resource passes this rule when loggingLevel must not equal OFF. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable logging to capture audit and operational events for security investigation. In AWS Console: Resource > Settings > enable logging. See: https://docs.aws.amazon.com/prescriptive-guidance/latest/logging-monitoring-best-practices/welcome.html

Terraform

resource "aws_sfn_state_machine" "{name}" {
  logging_configuration {
    log_destination        = "${aws_cloudwatch_log_group.sfn.arn}:*"
    include_execution_data = true
    level                  = "ALL"
  }
}

Compliance frameworks

Cloud Security: AWS Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan