serverless-step-functions plugin is not using provider.iam.role.path

[stavros-liaskos]

Bug report

Issue

Generated step functions roles are ignoring the path defined under provider.iam.role.path.

How to reproduce

1. Create a serverless.yml with lambdas and step functions
2. Set provider.iam.role.path: /teamA/ to streamline access management
3. Deploy cloudformation stack
4. Engineers outside teamA cannot update Cloudformation stack.

Lambda iam role is generated with path:

"IamRoleLambdaExecution": {
  "Type": "AWS::IAM::Role",
  "Properties": {
    "AssumeRolePolicyDocument": {
      ...
    },
    "Policies": [
      ...
    ],
    "Path": "/teamA/",
    "RoleName": "...",
    "ManagedPolicyArns": []
  }
}     

Step function role is generated without path:

{
  "Type": "AWS::IAM::Role",
  "Properties": {
    "AssumeRolePolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "events.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    },
    "Policies": [
      {
        "PolicyName": "some-name",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "states:StartExecution"
              ],
              "Resource": {
                "Ref": "some-ref"
              }
            }
          ]
        }
      }
    ]
  }
}

---

The fix likely is in updating the IAM role templates e.g. here, here, etc.

What are your thoughts? Would that be a breaking change?

Thank you for this great plugin!

[zirkelc]

HI @stavros-liaskos

thanks for opening this issue. It's honestly the first time I heard about IAM paths 😅 would you be interested in submitting a fix?

[VirtueMe]

We've implemented a fix that applies provider.iam.role.path to all IAM roles generated by the plugin (state machine execution, scheduled events, CloudWatch/EventBridge events, API Gateway, and notifications). PR: #674