Terraform AWS Step Functions

State machines with IAM execution roles, logging, tracing, retries, timeouts, and workflow definitions for auditable application orchestration.

Quick start

module "step-functions" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"

  # ... your arguments here
}

module "step-functions" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"

  # ... your arguments here
}

module "step-functions" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"

  # ... your arguments here
}

module "step-functions" {
  source  = "soc2.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"

  # ... your arguments here
}

module "step-functions" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"

  # ... your arguments here
}

module "step-functions" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"

  # ... your arguments here
}

module "step-functions" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"

  # ... your arguments here
}

module "step-functions" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "step-functions" {
  source  = "terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"
}

module "step-functions" {
  source  = "soc2.compliance.tf/terraform-aws-modules/step-functions/aws"
  version = "~> 5.1"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "step-functions" {
  source  = "terraform-aws-modules/step-functions/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 3 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
CloudWatch log groups should have retention period of at least 365 days	Low
Log groups should have encryption at rest enabled	Low
Step Functions state machines should have logging enabled	Low

Mapped compliance frameworks

Clause	Controls from this module
16 Business Continuity	Step Functions state machines should have logging enabled
17 Archiving	CloudWatch log groups should have retention period of at least 365 days
7.1 Data Storage - Damage Protection	Log groups should have encryption at rest enabled

Clause	Controls from this module
A.8.15 Logging	CloudWatch log groups should have retention period of at least 365 days Log groups should have encryption at rest enabled Step Functions state machines should have logging enabled
A.8.16 Monitoring activities	CloudWatch log groups should have retention period of at least 365 days Log groups should have encryption at rest enabled
A.8.24 Use of cryptography	Log groups should have encryption at rest enabled

Clause	Controls from this module
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.	Step Functions state machines should have logging enabled
10.3.1: Audit logs are protected from destruction and unauthorized modifications.	Step Functions state machines should have logging enabled
10.3.2: Audit logs are protected from destruction and unauthorized modifications.	Log groups should have encryption at rest enabled
10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify	Log groups should have encryption at rest enabled
10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts	Log groups should have encryption at rest enabled
10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis	CloudWatch log groups should have retention period of at least 365 days
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.	Step Functions state machines should have logging enabled
3.2.1: Storage of account data is kept to a minimum.	CloudWatch log groups should have retention period of at least 365 days
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.	CloudWatch log groups should have retention period of at least 365 days
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.	CloudWatch log groups should have retention period of at least 365 days
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.	CloudWatch log groups should have retention period of at least 365 days
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.	CloudWatch log groups should have retention period of at least 365 days
3.5.1: Primary account number (PAN) is secured wherever it is stored.	Log groups should have encryption at rest enabled
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.	CloudWatch log groups should have retention period of at least 365 days Step Functions state machines should have logging enabled
8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components	Log groups should have encryption at rest enabled
A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities	Log groups should have encryption at rest enabled Step Functions state machines should have logging enabled

Clause	Controls from this module
A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives	Step Functions state machines should have logging enabled
C1.2 The entity disposes of confidential information to meet the entity's objectives related to confidentiality	CloudWatch log groups should have retention period of at least 365 days
CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.	CloudWatch log groups should have retention period of at least 365 days
CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures	CloudWatch log groups should have retention period of at least 365 days Log groups should have encryption at rest enabled
P4.2 The entity retains personal information consistent with the entity's objectives related to privacy	CloudWatch log groups should have retention period of at least 365 days
PI1.3 Data is processed completely, accurately, and timely as authorized to meet the entity's processing integrity commitments and system requirements	Step Functions state machines should have logging enabled
PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements	Log groups should have encryption at rest enabled

Clause	Controls from this module
ACSC-EE-ML2-7.7: Multi-factor authentication ML2	Step Functions state machines should have logging enabled
ACSC-EE-ML3-7.9: Multi-factor authentication ML3	Log groups should have encryption at rest enabled

Clause	Controls from this module
Data protection	Log groups should have encryption at rest enabled
Identity and access management	CloudWatch log groups should have retention period of at least 365 days

Clause	Controls from this module
11.10(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period	CloudWatch log groups should have retention period of at least 365 days
11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records	CloudWatch log groups should have retention period of at least 365 days
11.30 Controls for open systems	Log groups should have encryption at rest enabled

Clause	Controls from this module
Audit Record Retention (AU-11)	CloudWatch log groups should have retention period of at least 365 days
Protection of Audit Information (AU-9)	Log groups should have encryption at rest enabled

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	PCI DSS v4.0	SOC 2
CloudWatch log groups should have retention period of at least 365 days	Enforced	Enforced
Log groups should have encryption at rest enabled	Enforced	Enforced
Step Functions state machines should have logging enabled	Enforced	Enforced

3 controls enforced with a source URL change.

Start free trial Get started