StepFunctions.1: State machines should have logging on

What does AWS Security Hub StepFunctions.1 check?

StepFunctions.1 checks that a Step Functions state machine has logging enabled. It reports FAILED when a state machine has no LoggingConfiguration, which is the default for Standard workflows.

Why does StepFunctions.1 matter?

How much you lose without logging depends on the workflow type. Express Workflows don't record execution history in Step Functions at all, so with logging off they run dark: there is no record of which state transitioned where or with what payload, making incident investigation guesswork. Standard Workflows do retain full execution history in Step Functions itself (viewable in the console and via the API for up to 90 days), but routing it to CloudWatch Logs is what gives you durable, queryable, longer-lived records for debugging and security auditing across both workflow types.

How do I fix StepFunctions.1?

1. Audit which state machines have no LoggingConfiguration.
2. Choose a log level: ALL for full visibility, or ERROR/FATAL to capture only failures and reduce volume.
3. Grant the state machine's execution role the CloudWatch Logs delivery permissions it needs.
4. Enable logging with a non-disruptive update-state-machine call that does not interrupt running executions.

# Verify the prerequisite first: API Gateway's account-level CloudWatch role.
# Without it, the logging setting saves but no logs ever flow.
aws apigateway get-account --query 'cloudwatchRoleArn' --output text

# Enable ERROR-level execution logging on every stage of a REST API.
REST_API=a1b2c3d4e5
for STAGE in $(aws apigateway get-stages --rest-api-id $REST_API \
  --query 'item[].stageName' --output text); do
  aws apigateway update-stage --rest-api-id $REST_API --stage-name $STAGE \
    --patch-operations op=replace,path=/*/*/logging/loglevel,value=ERROR
done

# Cap retention on the log group so storage stays bounded (do this every time you enable logging).
aws logs put-retention-policy \
  --log-group-name "API-Gateway-Execution-Logs_${REST_API}/prod" \
  --retention-in-days 90

# Example for a managed database: publish engine logs to CloudWatch (no per-event charge).
aws rds modify-db-instance --db-instance-identifier prod-db \
  --cloudwatch-logs-export-configuration 'EnableLogTypes=["error","audit"]' --apply-immediately