title: Nested Step Function in a Step Function: Unknown Error: "...not authorized to create managed-rule"
body: <p>I have a Step Function (Parent) created in a SAM/CloudFormation template that, among other things, calls another Step Function (Child). I'm following the instructions on calling Child, from Parent, using the <a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-stepfunctions.html" rel="noreferrer">service integration pattern</a>. But I'm getting an IAM-related (I think) error I can't resolve when deploying via the CLI. <em>(The error manifests in the CLI output, so it never actually makes it into AWS. There have been plenty of prior deployments, so the <code>changeset</code> is just trying to modify the Step Function with this deployment.)</em></p>
  
  <blockquote>
    <p><code>'arn:aws:iam::{Account-Number}:role/{Parent-Step-Function-Role-Name}' is not authorized to create managed-rule. (Service: AWSStepFunctions; Status Code: 400; Error Code: AccessDeniedException; Request ID: {Long-Id-Number})</code></p>
  </blockquote>
  
  <p>To get the synchronous behavior I want (Parent calls Child, waits for execution of Child to complete, then moves onto the next State) I use the suggestion (from the service integration pattern link above) to create a task (in my SAM template) that looks like the following:</p>
  
  <pre><code>...More States...
  
  "Call Child State": {
    "Type": "Task",
    "Next": "The Next State",
    "Resource": "arn:aws:states:::states:startExecution.sync",
    "Parameters": {  
      "Input": {
        "comment": "Hello World!"
      },
      "StateMachineArn": "${ChildStepFunction}",
      "Name": "ChildExecutionFromParent"
    }
  },
  
  ...More States...
  </code></pre>
  
  <p>I've defined the IAM-role for Parent as follows, making sure that it only has Lambda execution privileges for the Lambda functions in Parent, and, more applicably to the problem, has permission to <code>StartExecution</code> of Child. I followed the instructions in the link just below, that stated StartExecution was the only permission needed when using the service integration pattern.</p>
  
  <p><a href="https://docs.aws.amazon.com/step-functions/latest/dg/stepfunctions-iam.html" rel="noreferrer">https://docs.aws.amazon.com/step-functions/latest/dg/stepfunctions-iam.html</a></p>
  
  <pre><code>ParentStepFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - !Sub states.${AWS::Region}.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        -
          PolicyName: ChildStepFunctionExecution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action: states:StartExecution
                Resource: !Ref ChildStepFunction
              -
                Effect: Allow
                Action: lambda:InvokeFunction
                Resource:
                    - !GetAtt Function1.Arn
                    ...
                    - !GetAtt FunctionX.Arn
  </code></pre>
  
  <p>I've tried replacing the above State with a simple <code>Pass</code> State to make sure there were no other errors in the Step Function blocking the deployment, and it deployed fine. So I know it has to do with that State. (Also of note, when deploying with the <code>Pass</code> State for testing, I left the role as defined above, so, again, I know it's not a syntax error with the Policies that would be causing this. Obviously, that's not the same as perhaps having the <em>wrong</em> or <em>missing</em> policies.)</p>