Check ID: stepfunctions_statemachine_no_secrets_in_definition
Provider: AWS
Service: stepfunctions
Severity: CRITICAL
Categories: secrets
Resource type: AwsStepFunctionStateMachine

​
What this check verifies

AWS Step Functions state machines are inspected for hardcoded secrets (keys, tokens, passwords) embedded directly in the state machine definition (Amazon States Language JSON). Such values indicate sensitive data is stored directly in task parameters instead of being sourced securely.

​
Risk

Plaintext secrets in state machine definitions reduce confidentiality: values can be viewed in the AWS Console, CLI, and may leak into execution logs or public outputs. Compromised credentials enable unauthorized AWS actions, lateral movement, and data exfiltration.

​
Recommendation

Store secrets outside the state machine definition and retrieve them securely at runtime using AWS Secrets Manager or AWS Systems Manager Parameter Store.
  • Use the aws-sdk:secretsmanager:getSecretValue integration to fetch secrets dynamically
  • Enforce least privilege on the state machine IAM role
  • Rotate secrets regularly and never embed them in the definition

​
Remediation

resource "aws_sfn_state_machine" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_arn>"

  definition = jsonencode({
    Comment = "Example state machine"
    StartAt = "MyTask"
    States = {
      MyTask = {
        Type     = "Task"
        Resource = "arn:aws:states:::aws-sdk:secretsmanager:getSecretValue"
        Parameters = {
          SecretId = "<example_secret_name>"  # Reference secret by name, never hardcode value
        }
        End = true
      }
    }
  })
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = stepfunctions_statemachine_no_secrets_in_definition. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks