Step Functions state machine should have logging enabled

What it checks

Step Functions state machine: logging is disabled or set to OFF.

Where it applies

Terraform: aws_sfn_state_machine

CloudFormation: AWS::StepFunctions::StateMachine

How to fix it

1. Set logging_configuration { level = "ERROR" } and add a CloudWatch log group destination. Use level = "ALL" for debugging, "ERROR" for production.

Frameworks

• AWS FSBP StepFunctions.1
• SOC 2 CC7.2
• PCI-DSS v4.0.1/10.4.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules