stepfunctions: Generated Policy for StateMachine Incorrect for StepFunctionsStartExecution step with Aliasing/Versioning

[mpd18]

Describe the bug

When Creating a StateMachine construct that has a StepFunctionsStartExecution step that starts a state machine with an alias the generated policy is not correct.

const startStateMachineAlias = new StepFunctionsStartExecution(stack, 'StartStepFunctionAlias', {
    stateMachine: StateMachine.fromStateMachineArn(stack, 'StateMachineAlias', 'arn:aws:states:us-west-2:12345678900:stateMachine:stateMachine1:alias'),
  });

new StateMachine(stack, 'StateMachine', {
    stateMachineEntryPoint: startStateMachineAlias,
  });

the created policy will have a statement that looks like

{
  "Action": "states:StartExecution",
  "Effect": "Allow",
  "Resource": "arn:aws:states:us-west-2:12345678900:stateMachine:stateMachine1:alias",
}

Expected Behavior

Based on the AWS doc For executing aliases or versions you need to have a policy statement that looks like this

{
  "Action": "states:StartExecution",
  "Effect": "Allow",
  "Resource": "arn:aws:states:us-west-2:12345678900:stateMachine:stateMachine1",
}

or this

{
  "Action": "states:StartExecution",
  "Effect": "Allow",
  "Resource": "arn:aws:states:us-west-2:12345678900:stateMachine:stateMachine1",
  "Condition": {
      "ForAnyValue:StringEquals": {
        "states:StateMachineQualifier": [
          "alias"
        ]
      }
    }
}

Current Behavior

the created policy looks like this which is incorrect for executing an alias

{
  "Action": "states:StartExecution",
  "Effect": "Allow",
  "Resource": "arn:aws:states:us-west-2:12345678900:stateMachine:stateMachine1:alias",
}

Reproduction Steps

Create a StateMachine Construct that has a step that calls another state machine

const startStateMachineAlias = new StepFunctionsStartExecution(stack, 'StartStepFunctionAlias', {
    stateMachine: StateMachine.fromStateMachineArn(stack, 'StateMachineAlias', 'arn:aws:states:us-west-2:12345678900:stateMachine:stateMachine1:alias'),
  });

new StateMachine(stack, 'StateMachine', {
    stateMachineEntryPoint: startStateMachineAlias,
  });

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.115.0

Framework Version

No response

Node.js Version

18

OS

Amazon Linux 2

Language

TypeScript

Language Version

4.9.5

Other information

No response

[pahud]

Yes we should handle this from here

aws-cdk/packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts

Lines 448 to 451 in 168cdac

	graph = new StateGraph(definitionBody.chainable.startState, 'State Machine definition');
	graph.timeout = props.timeout;
	for (const statement of graph.policyStatements) {
	this.addToRolePolicy(statement);

and probably in the StateGraph as well.