fix(stepfunctions): allow disable x-ray

packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions/test/integ.state-machine-disable-xray.ts

@@ -0,0 +1,25 @@
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as cdk from 'aws-cdk-lib';
+import * as sfn from 'aws-cdk-lib/aws-stepfunctions';
+/*
+ * Stack verification steps:
+ *
+ * -- aws stepfunctions describe-state-machine --state-machine-arn <stack-output> has a status of `ACTIVE`
+ * -- aws iam get-role-policy --role-name <role-name> --policy-name <policy-name> has all actions mapped to respective resources.
+ */
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-stepfunctions-integ');
+
+// const role = new iam.Role(stack, 'Role', {
+//   assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+// });
+
+const stateMachine = new sfn.StateMachine(stack, 'StateMachine', {
+  comment: 'a super cool state machine',
+  tracingEnabled: false,
+});
+
+// stateMachine.grantRead(role);
+// stateMachine.grant(role, 'states:SendTaskSuccess');
+
+app.synth();

packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts

@@ -457,7 +457,7 @@ export class StateMachine extends StateMachineBase {
       stateMachineType: props.stateMachineType ?? undefined,
       roleArn: this.role.roleArn,
       loggingConfiguration: props.logs ? this.buildLoggingConfiguration(props.logs) : undefined,
-      tracingConfiguration: props.tracingEnabled ? this.buildTracingConfiguration() : undefined,
+      tracingConfiguration: this.buildTracingConfiguration(props.tracingEnabled),
       ...definitionBody.bind(this, this.role, props, graph),
       definitionSubstitutions: props.definitionSubstitutions,
     });
@@ -532,21 +532,27 @@ export class StateMachine extends StateMachineBase {
     };
   }
 
-  private buildTracingConfiguration(): CfnStateMachine.TracingConfigurationProperty {
-    this.addToRolePolicy(new iam.PolicyStatement({
-      // https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources
-      // https://docs.aws.amazon.com/step-functions/latest/dg/xray-iam.html
-      actions: [
-        'xray:PutTraceSegments',
-        'xray:PutTelemetryRecords',
-        'xray:GetSamplingRules',
-        'xray:GetSamplingTargets',
-      ],
-      resources: ['*'],
-    }));
+  private buildTracingConfiguration(isTracing?: boolean): CfnStateMachine.TracingConfigurationProperty | undefined {
+    if (isTracing === undefined) {
+      return undefined;
+    }
+
+    if (isTracing) {
+      this.addToRolePolicy(new iam.PolicyStatement({
+        // https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources
+        // https://docs.aws.amazon.com/step-functions/latest/dg/xray-iam.html
+        actions: [
+          'xray:PutTraceSegments',
+          'xray:PutTelemetryRecords',
+          'xray:GetSamplingRules',
+          'xray:GetSamplingTargets',
+        ],
+        resources: ['*'],
+      }));
+    }
 
     return {
-      enabled: true,
+      enabled: isTracing,
     };
   }
 }

packages/aws-cdk-lib/aws-stepfunctions/test/state-machine.test.ts

@@ -348,6 +348,25 @@ describe('State Machine', () => {
     });
   });
 
+  test('disable tracing configuration', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    new sfn.StateMachine(stack, 'MyStateMachine', {
+      definitionBody: sfn.DefinitionBody.fromChainable(sfn.Chain.start(new sfn.Pass(stack, 'Pass'))),
+      tracingEnabled: false,
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::StepFunctions::StateMachine', {
+      DefinitionString: '{"StartAt":"Pass","States":{"Pass":{"Type":"Pass","End":true}}}',
+      TracingConfiguration: {
+        Enabled: false,
+      },
+    });
+  });
+
   test('grant access', () => {
     // GIVEN
     const stack = new cdk.Stack();