Step FunctionsのSDKサービス統合を使って多重実行を許容しないステートマシンを構築する

Type: Task
Resource: arn:aws:states:::aws-sdk:serviceName:apiAction.[serviceIntegrationPattern]

Type: Task
Resource: arn:aws:states:::aws-sdk:sfn:listExecutions

Type: Task
Resource: "arn:aws:states:::aws-sdk:sfn:listExecutions"
Parameters:
    StateMachineArn: "(state machine arnを記載)"

.
└── terraform
    └── workflow
        ├── iam_state_machine.tf
        ├── sfn_state_machine.tf
        ├── templates
        │   └── state_machine
        │       └── check_duplicate_execution.asl.yaml
        └── variables.tf

StartAt: Count running executions
States:
    Count running executions:
        Next: Choice
        # SDKサービス統合を使用するにはTypeフィールドでTaskを指定する
        Type: Task
        #SDK統合サービス統合でAPIアクションlistExecutionsを使用
　        Resource: "arn:aws:states:::aws-sdk:sfn:listExecutions"         
        # 実行数を取得したいので、組み込み関数States.ArrayLengthを使用。詳細は後述。
        # 実行数はcountに格納される。
        ResultSelector:
            count.$: "States.ArrayLength($.Executions)"
        ResultPath: $.result
        Parameters:
            # StateMachineArn: 実行情報を取得するステートマシンのARN。ここではこのステートマシンのARNを指定。
            StateMachineArn: "arn:aws:states:ap-northeast-1:${aws_account_id}:stateMachine:check-duplicate-execution"
            # StatusFilter: ステータスで絞り込み。ここではRUNNING（現在実行中）を指定。
            StatusFilter: "RUNNING"
    Choice:
        Type: Choice
        Choices:
            # 実行数が2以上の場合、Fail Stateに移行するようにする。
            - Variable: $.result.count
              NumericGreaterThanEquals: 2
              Next: Fail State
        Default: Wait
    Fail State:
        Type: Fail
        Cause: "state machines duplicate execution"
    Wait:
        End: true
        Type: Wait
        Seconds: 300

% aws stepfunctions list-executions --state-machine-arn "arn:aws:states:ap-northeast-1:{aws_account_id}:stateMachine:check-duplicate-execution" --status-filter "RUNNING"
{
    "executions": [
        {
            "executionArn": "arn:aws:states:ap-northeast-1:{aws_account_id}:execution:check-duplicate-execution:b93f0a79-1467-4c35-84e2-cffd5fa05bdd",
            "stateMachineArn": "arn:aws:states:ap-northeast-1:{aws_account_id}:stateMachine:check-duplicate-execution",
            "name": "b93f0a79-1467-4c35-84e2-cffd5fa05bdd",
            "status": "RUNNING",
            "startDate": "2024-03-24T18:13:55.253000+09:00"
        }
    ]
}

resource "aws_sfn_state_machine" "state_machine_check_duplicate_execution" {
  name     = "check-duplicate-execution"
  role_arn = aws_iam_role.state_machine_check_duplicate_execution_iam_role.arn
  definition = jsonencode(yamldecode(templatefile("${path.module}/templates/state_machine/check_duplicate_execution.asl.yaml", {
    aws_account_id = data.aws_caller_identity.current.account_id
    }
    )
  ))
}

# ロール
data "aws_iam_policy_document" "state_machine_check_duplicate_execution_iam_role_document" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["states.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "state_machine_check_duplicate_execution_iam_role" {
  name               = "state-machine-check-duplicate-execution"
  assume_role_policy = data.aws_iam_policy_document.state_machine_check_duplicate_execution_iam_role_document.json
}

# IAMポリシー
# ステートマシンがSDKサービス統合のAPIアクションlist-executionsを使用することを許可する
data "aws_iam_policy_document" "state_machine_check_duplicate_execution_iam_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "states:ListExecutions"
    ]
    # list-executionsで実行情報を取得できるステートマシンを指定する。ここではワイルドカードを指定し　　任意のステートマシンの実行情報を取得できるようにしている。
    resources = ["*"]
  }
}

# IAMポリシーアタッチ
resource "aws_iam_policy" "state_machine_check_duplicate_execution_iam_policy" {
  name   = "state-machine-check-duplicate-execution"
  policy = data.aws_iam_policy_document.state_machine_check_duplicate_execution_iam_policy_document.json
}

resource "aws_iam_policy_attachment" "state_check_duplicate_execution_role_policy" {
  name       = "state-machine-check-duplicate-policy-attachment"
  roles      = [aws_iam_role.state_machine_check_duplicate_execution_iam_role.name]
  policy_arn = aws_iam_policy.state_machine_check_duplicate_execution_iam_policy.arn
}

data "aws_caller_identity" "current" {}