Step Functions state machine has logging enabled

Check ID: stepfunctions_statemachine_logging_enabled
Provider: AWS
Service: stepfunctions
Severity: MEDIUM
Categories: logging
Resource type: AwsStepFunctionStateMachine

What this check verifies

AWS Step Functions state machines are configured to emit execution logs to CloudWatch Logs via a defined loggingConfiguration with a level set above OFF.

Risk

Without execution logs, workflow failures and anomalies are undetectable, increasing MTTR and risking silent data loss. Missing audit trails weaken integrity oversight and complicate forensics, enabling misuse of invoked services to go unnoticed and creating compliance gaps.

Recommendation

Enable CloudWatch logging on all state machines at an appropriate level (e.g., ERROR or ALL) and send logs to a protected log group. Apply least privilege to log write/read, set retention, and avoid sensitive data unless required using includeExecutionData. Use X-Ray tracing for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws stepfunctions update-state-machine —state-machine-arn <state-machine-arn> —logging-configuration file://logging-config.json

resource "aws_sfn_state_machine" "<example_resource_name>" {
  name       = "<example_resource_name>"
  role_arn   = "arn:aws:iam::<account-id>:role/<example_role_name>"
  definition = jsonencode({ StartAt = "Pass", States = { Pass = { Type = "Pass", End = true } } })

  logging_configuration {
    log_destination = "arn:aws:logs:<region>:<account-id>:log-group:<log-group-name>:*"  # Critical: CloudWatch Logs destination
    level           = "ERROR"                                                              # Critical: enables logging
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: arn:aws:iam::<account-id>:role/<example_role_name>
      DefinitionString: |
        {"StartAt":"Pass","States":{"Pass":{"Type":"Pass","End":true}}}
      LoggingConfiguration:
        Destinations:
          - CloudWatchLogsLogGroup:
              LogGroupArn: arn:aws:logs:<region>:<account-id>:log-group:<log-group-name>:*  # Critical: target CloudWatch Logs group
        Level: ERROR  # Critical: enables logging (not OFF)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = stepfunctions_statemachine_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

SSM Incidents replication set is ACTIVE with a plan Step Functions state machine definition has no secrets

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires