Step Functions state machines should have logging turned on

How to fix it

In the console

Step Functions → State machines → the state machine → Edit → Config mode → Logging

Log level

ALL, ERROR or FATAL; ERROR records failures, ALL every execution event

Log group

A CloudWatch Logs log group; a name starting /aws/vendedlogs/states avoids the log resource policy size limit

Include execution data

Off unless you need state inputs and outputs in the logs

Execution role

Allows logs:CreateLogDelivery, logs:GetLogDelivery and the other log delivery actions on Resource "*"

With the AWS CLI

aws stepfunctions update-state-machine --state-machine-arn <state-machine-arn> --role-arn <execution-role-arn> --logging-configuration '{"level":"ERROR","includeExecutionData":false,"destinations":[{"cloudWatchLogsLogGroup":{"logGroupArn":"<log-group-arn>:*"}}]}' --region <region>

With Terraform

resource "aws_sfn_state_machine" "this" {
  name       = var.state_machine_name
  role_arn   = var.execution_role_arn
  definition = var.definition

  logging_configuration {
    level                  = "ERROR"
    include_execution_data = false
    log_destination        = "${var.log_group_arn}:*"
  }
}