Checks if AWS Step Functions machine has logging enabled. The rule is NON_COMPLIANT if a state machine does not have logging enabled or the logging configuration is not at the minimum level provided.

This config rule supports the following parameters:

  • cloudWatchLogGroupArns
    • Required: No
    • Type: CSV
    • Description:Comma-separated list of Amazon Resource Names (ARNs) for Amazon CloudWatch Logs log groups. The rule checks if the specified log groups are configured for your state machine logs.
  • logLevel
    • Required: No
    • Type: String
    • Description:The minimum log level for your state machine. Valid values include: ALL, ERROR, FATAL.

CloudFormation Template