Nested workflow - The security token included in the request is invalid

Question

I use the local docker StepFunctions setup and try to invoke StateMachine within a StateMachine (nested workflow), using sync or waitForTaskToken . But have this error (see below).

Does anyone know what this means? Is it because local StepFunctions service don't allow StateMachine calling another StateMachine?

2021-01-15 02:11:03.336: arn:aws:states:us-east-1:123456789012:execution:Foobar-Dev:6bae52c1-3562-44a5-88fd-68a533f054bf : 
{
    "Type":"TaskFailed",
    "PreviousEventId":29,
    "TaskFailedEventDetails":{
        "ResourceType":"states",
        "Resource":"startExecution.sync",
        "Error":"StepFunctions-AWSStepFunctionsException",
        "Cause":"The security token included in the request is invalid. (Service: AWSStepFunctions; Status Code: 400; Error Code: UnrecognizedClientException; Request ID: ca3a983d-3496-4d48-854a-1bb803a44f2a; Proxy: null)"
    }
}

Main workflow definition:

    "FoobarWorkflow": {
      "Type": "Task",
      "Resource": "arn:aws:states:::states:startExecution.sync",
      "Parameters": {
        "StateMachineArn": "arn:aws:states:us-east-1:123456789012:stateMachine:Foobar-Dev",
        "Input": {
          "NeedCallback": false,
          "AWS_STEP_FUNCTIONS_STARTED_BY_EXECUTION_ID.$": "$$.Execution.Id"
        }
      },

Child workflow definition:

{
    "Comment": "Foobar-Dev",
    "StartAt": "Screening",
    "Version": "1.0",
    "TimeoutSeconds": 480,
    "States": {
        "Screening": {
            "Type": "Task",
            "Resource": "arn:aws:states:us-east-1:123456789012:activity:ScreeningActivity-Dev",
            "Next": "ScreeningChoiceState",
            "Retry": [
              {
                "ErrorEquals": [
                  "States.TaskFailed",
                  "States.Runtime"
                ],
                "IntervalSeconds": 3,
                "MaxAttempts": 3,
                "BackoffRate": 2
              }
            ],
            "Catch": [
              {
                "ErrorEquals": [
                  "States.TaskFailed",
                  "States.Runtime"
                ],
                "Next": "DefaultSystemFailure",
                "ResultPath": "$.error"
              },
              {
                "ErrorEquals": [
                  "States.ALL"
                ],
                "Next": "DefaultSystemFailure",
                "ResultPath": "$.error"
              }
            ]
        },
        ...
 "ScreeningFinalDecision": {
            "Type": "Task",
            "Resource": "arn:aws:states:us-east-1:123456789012:activity:ScreeningFinalDecision-Dev",
            "End": true
        }

Answer 1

After some digging, it seems like for local StepFunction docker setup, we need to pass additional environment variables for access_key_id and secret_access_key to enable the nested workflow to work.

The doc talks about this here .

To configure Step Functions Local for Docker, create the following file: aws-stepfunctions-local-credentials.txt .

This file contains your credentials and other configuration options, such as the following.

 AWS_DEFAULT_REGION=AWS_REGION_OF_YOUR_AWS_RESOURCES AWS_ACCESS_KEY_ID=YOUR_AWS_ACCESS_KEY AWS_SECRET_ACCESS_KEY=YOUR_AWS_SECRET_KEY

Once you have configured your credentials and configuration options in aws-stepfunctions-local-credentials.txt, start Step Functions with the following command.

 docker run -p 8083:8083 --env-file aws-stepfunctions-local-credentials.txt amazon/aws-stepfunctions-local