Checks if AWS Step Functions machine has logging enabled. The rule is NON_COMPLIANT if a state machine does not have logging enabled or the logging configuration is not at the minimum level provided.
Identifier: STEP_FUNCTIONS_STATE_MACHINE_LOGGING_ENABLED
Resource Types: AWS::StepFunctions::StateMachine
Trigger type: Configuration changes
AWS Region: All supported AWS regions except Asia Pacific (Thailand), Asia Pacific (Malaysia), Asia Pacific (Melbourne), AWS GovCloud (US-East), AWS GovCloud (US-West), Mexico (Central), Israel (Tel Aviv), Canada West (Calgary) Region
Parameters:
- cloudWatchLogGroupArns (Optional)
- Type: CSV
-
Comma-separated list of Amazon Resource Names (ARNs) for Amazon CloudWatch Logs log groups. The rule checks if the specified log groups are configured for your state machine logs.
- logLevel (Optional)
- Type: String
-
The minimum log level for your state machine. Valid values include: ALL, ERROR, FATAL.
AWS CloudFormation template
To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.
