AWS Step Functions

AWS Step Functions is the AWS serverless workflow orchestrator. Polysync uses the official AWS SDK for .NET v4 (AWSSDK.StepFunctions and AWSSDK.SecurityToken) to list state machines, start executions with a JSON input, poll execution status, parse output parameters from the execution result, and surface a direct link to the AWS Step Functions console for monitoring.

Required attributes

• Region — the AWS region containing the state machine (e.g., us-east-1, ap-southeast-2). All Step Functions API calls are region-scoped.

Optional platform-level defaults

• Trace Header — an AWS X-Ray trace header propagated to the execution. Allows linking Polysync executions to an X-Ray trace. Overridable per job.

Authentication methods

• Web Identity Federation ⭐ (recommended for Polysync SaaS) — Polysync exchanges its Microsoft Entra ID workload identity token for short-lived AWS credentials via sts:AssumeRoleWithWebIdentity. No long-lived secrets stored. Required attributes: Role ARN.
  • In AWS, create an IAM Identity Provider (OIDC) trusting Polysync's Entra ID issuer (https://login.microsoftonline.com/<polysync-tenant-id>/v2.0) with audience sts.amazonaws.com.
  • Create an IAM role whose trust policy allows sts:AssumeRoleWithWebIdentity from that provider with a condition on the Polysync workload identity's sub/oid claim.
• Access Key — Provide Access Key Id, Secret Access Key, and optionally Session Token. Simplest, but the secret must be rotated and stored in a Secret Vault.
• Assume Role — Provide a bootstrap Access Key Id and Secret Access Key, plus the Role ARN to assume. The bootstrap user only needs sts:AssumeRole on the target role; the assumed role holds the Step Functions permissions.
• Instance Profile — Uses the host EC2/ECS instance profile. Only viable when Polysync is deployed inside AWS.

IAM permissions checklist

The role / user used to call Step Functions must hold (at minimum):

• states:ListStateMachines — discover available state machines.
• states:DescribeStateMachine — read state machine metadata, including ARN, type, and execution role.
• states:StartExecution — start executions (scope to specific state-machine ARNs in production).
• states:DescribeExecution — poll execution status and read output.
• states:StopExecution — cancel running executions.

Plus any IAM permissions the state machine's own execution role needs to call downstream services (defined on the state machine's role, not the Polysync caller).

Supported jobs

• AWS Step Functions State Machine — starts a Standard or Express execution with a JSON input.

Troubleshooting

• AccessDeniedException on listing state machines — the caller is missing states:ListStateMachines in the target region.
• Web Identity Federation InvalidIdentityToken — check that the IAM Identity Provider's thumbprint matches login.microsoftonline.com, the audience is sts.amazonaws.com, and the role trust policy allows the Polysync workload identity's sub / oid.