# IamRoleStateMachineExecution - Policy statement must contain resources

**URL:** <https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594>\
**Category:** Serverless Framework\
**Created:** [August 27, 2018, 5:00pm UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594 "2018-08-27T17:00:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ishanjain28](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/ishanjain28/32/2450_2.png) [@ishanjain28](https://forum.serverless.com/u/ishanjain28)\
**Post date:** [August 27, 2018, 5:00pm UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/1 "2018-08-27T17:00:40Z")

</div>

I have the following serverless configuration file and I keep getting this error. I have no clue what to do. Please point me to what am I doing wrong.

```auto
An error occurred: IamRoleStateMachineExecution - Policy statement must contain resources. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 1306e9e2-aa17-11e8-990a-1bb7f9dda8ba).

```

```auto
service: abc

plugins:
  - serverless-step-functions
  - serverless-pseudo-parameters

provider:
  name: aws
  runtime: go1.x
  timeout: 30
  region: eu-west-1
  apiKeys:
    - ${opt:stage}

  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "s3:GetObject"
        - "s3:PutObject"
        - "s3:DeleteObject"
        - "logs:FilterLogEvents"
      Resource: "*"

package:
 exclude:
   - ./**
 include:
   - ./create-task-fn
   - ./s3-ftp-upload-fn
   - ./${opt:stage}.config.json

functions:
  CreateTask:
    handler: create-task-fn
    memorySize: 192
    environment:
      # Cloudwatch region
      REGION: ${self:provider.region}
      CONFIG: ${opt:stage}.config.json
  S3FtpUpload:
    handler: s3-ftp-upload-fn
    memorySize: 256
    environment:
      CONFIG: ${opt:stage}.config.json

stepFunctions:
  stateMachines:
    abc:
      events:
        - http:
            path: /
            method: post
      name: Abc
      definition:
        Comments: "Abc Step function reads logs from cloudwatch, Process them and uploads them to a FTP server"
        StartAt: CreateTask
        States:
          CreateTask:
            Type: Task
            Resource: "arn:aws:lambda:${self:provider.region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-CreateTask"
            Next: S3FtpUpload
          S3FtpUpload:
            Type: Task
            Resource: "arn:aws:lambda:${self:provider.region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-S3FtpUpload"
            End: true

resources:
  Resources:
    CreateTaskTempBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: create-task-temp-store

```

---

<div class="post-metadata">

**Author:** ![sc112233](https://avatars.discourse-cdn.com/v4/letter/s/7993a0/32.png) [@sc112233](https://forum.serverless.com/u/sc112233)\
**Post date:** [August 28, 2018, 3:30am UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/2 "2018-08-28T03:30:40Z")

</div>

I’ve just run into this error message as well on a project where I’m also using:

```auto
plugins:
  - serverless-step-functions
  - serverless-pseudo-parameters

```

This is a serverless project that was working just fine, have deployed multiple times recently without any issue. I made a minor code change and now I’m hitting this when I try to deploy. It seems like something changed behind the scenes, but I’m not sure where…

Thanks in advance if anyone has any clues as to what’s going on.

---

<div class="post-metadata">

**Author:** ![sc112233](https://avatars.discourse-cdn.com/v4/letter/s/7993a0/32.png) [@sc112233](https://forum.serverless.com/u/sc112233)\
**Post date:** [August 28, 2018, 3:46am UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/3 "2018-08-28T03:46:31Z")

</div>

It looks like back-revving serverless-step-functions to version 1.6.1 resolves this issue for me. Looking through the logs in github, this changeset seems a likely candidate:

> <https://github.com/serverless-operations/serverless-step-functions/commit/f55a54758f7638ebd06391c8b83e9b333d8727e2>
>
> Restrict permissions given to the generated IAM role

… since it’s related to IAM role (according to the comments).

---

<div class="post-metadata">

**Author:** ![spongeboy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/spongeboy/32/2454_2.png) [@spongeboy](https://forum.serverless.com/u/spongeboy)\
**Post date:** [August 28, 2018, 7:32am UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/4 "2018-08-28T07:32:25Z")

</div>

I have logged this issue in the plugin’s Github-

> <https://github.com/serverless-operations/serverless-step-functions/issues/146>
>
> \# This is a Bug Report
> 
> \## Description
> 
> Also reported in \[Serverless forums\]…(https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594)
> 
> Using version 1.7.0 of plugin caused a deployment error of
> \`IamRoleStateMachineExecution - Policy statement must contain resources\`
> 
> We resolved the issue by downgrading back to version 1.6.1.
> 
> Apologies, but at the moment I am unable to supply a sample config, as I need strip out sensitive information.
> 
> Our step function uses parallel steps, and the same function is referenced in multiple steps.
> 
> \## Environment
> OS:                     linux
> Node Version:           8.9.4
> Serverless Version:     1.25.0

---

<div class="post-metadata">

**Author:** ![sc112233](https://avatars.discourse-cdn.com/v4/letter/s/7993a0/32.png) [@sc112233](https://forum.serverless.com/u/sc112233)\
**Post date:** [August 28, 2018, 1:22pm UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/5 "2018-08-28T13:22:07Z")

</div>

Thanks. I added some more detail to the bug report…

---

<div class="post-metadata">

**Author:** ![ishanjain28](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/ishanjain28/32/2450_2.png) [@ishanjain28](https://forum.serverless.com/u/ishanjain28)\
**Post date:** [August 28, 2018, 2:35pm UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/6 "2018-08-28T14:35:56Z")

</div>

Thank you so much. I pinned `serverless-step-functions` to `1.6.1` and everything worked just fine.

---

<div class="post-metadata">

**Author:** ![sc112233](https://avatars.discourse-cdn.com/v4/letter/s/7993a0/32.png) [@sc112233](https://forum.serverless.com/u/sc112233)\
**Post date:** [September 4, 2018, 1:54pm UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/7 "2018-09-04T13:54:50Z")

</div>

It looks like there was a new release that fixes this - but I haven’t tried it myself yet…

---

<div class="post-metadata">

**Author:** ![pcullin-ratio](https://avatars.discourse-cdn.com/v4/letter/p/ec9cab/32.png) [@pcullin-ratio](https://forum.serverless.com/u/pcullin-ratio)\
**Post date:** [September 6, 2018, 12:03am UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/8 "2018-09-06T00:03:22Z")

</div>

I tried with the 1.7.2 release (latest tagged release as of today), and still encountered this issue. But I can also confirm that pinning serverless-step-functions to 1.6.1 does work.

---

<div class="post-metadata">

**Author:** ![sulaysumaria](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/sulaysumaria/32/2683_2.png) [@sulaysumaria](https://forum.serverless.com/u/sulaysumaria)\
**Post date:** [October 24, 2018, 6:52am UTC](https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/9 "2018-10-24T06:52:29Z")

</div>

I was having the same error and it worked with serverless-step-functions@1.6.1