Back to Checks
aws

Step Functions state machine has logging enabled

stepfunctions_statemachine_logging_enabled
Service: stepfunctionsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsStepFunctionStateMachine

AWS Step Functions state machines are configured to emit execution logs to CloudWatch Logs via a defined loggingConfiguration with a level set above OFF.

Prowler logoProwlerprowler-provider-aws

Risk

Without execution logs, workflow failures and anomalies are undetectable, increasing MTTR and risking silent data loss. Missing audit trails weaken integrity oversight and complicate forensics, enabling misuse of invoked services to go unnoticed and creating compliance gaps.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks stepfunctions_statemachine_logging_enabled

Recommendation

Enable CloudWatch logging on all state machines at an appropriate level (e.g., ERROR or ALL) and send logs to a protected log group. Apply least privilege to log write/read, set retention, and avoid sensitive data unless required using includeExecutionData. Use X-Ray tracing for defense in depth.

Remediation

CLI

aws stepfunctions update-state-machine --state-machine-arn <state-machine-arn> --logging-configuration file://logging-config.json

Terraform

resource "aws_sfn_state_machine" "<example_resource_name>" {
  name       = "<example_resource_name>"
  role_arn   = "arn:aws:iam::<account-id>:role/<example_role_name>"
  definition = jsonencode({ StartAt = "Pass", States = { Pass = { Type = "Pass", End = true } } })

  logging_configuration {
    log_destination = "arn:aws:logs:<region>:<account-id>:log-group:<log-group-name>:*"  # Critical: CloudWatch Logs destination
    level           = "ERROR"                                                              # Critical: enables logging
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: arn:aws:iam::<account-id>:role/<example_role_name>
      DefinitionString: |
        {"StartAt":"Pass","States":{"Pass":{"Type":"Pass","End":true}}}
      LoggingConfiguration:
        Destinations:
          - CloudWatchLogsLogGroup:
              LogGroupArn: arn:aws:logs:<region>:<account-id>:log-group:<log-group-name>:*  # Critical: target CloudWatch Logs group
        Level: ERROR  # Critical: enables logging (not OFF)

Other

1Open AWS Console > Step Functions > State machines
2Select the state machine and click Edit
3In Logging, enable logging
4Choose an existing CloudWatch Logs log group
5Set Level to Error (or All)
6Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.stepfunctions.stepfunctions_client import (
    stepfunctions_client,
)
from prowler.providers.aws.services.stepfunctions.stepfunctions_service import (
    LoggingLevel,
)


class stepfunctions_statemachine_logging_enabled(Check):
    """
    Check if AWS Step Functions state machines have logging enabled.

    This class verifies whether each AWS Step Functions state machine has logging enabled by checking
    for the presence of a loggingConfiguration property in the state machine's configuration.
    """

    def execute(self) -> List[Check_Report_AWS]:
        """
        Execute the Step Functions state machines logging enabled check.

        Iterates over all Step Functions state machines and generates a report indicating whether
        each state machine has logging enabled.

        Returns:
            List[Check_Report_AWS]: A list of report objects with the results of the check.
        """
        findings = []
        for state_machine in stepfunctions_client.state_machines.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=state_machine)
            report.status = "PASS"
            report.status_extended = f"Step Functions state machine {state_machine.name} has logging enabled."

            if (
                not state_machine.logging_configuration
                or state_machine.logging_configuration.level == LoggingLevel.OFF
            ):
                report.status = "FAIL"
                report.status_extended = f"Step Functions state machine {state_machine.name} does not have logging enabled."
            findings.append(report)

        return findings

References