API Gateway から Step Functions を直接呼び出す方法

AWSTemplateFormatVersion: '2010-09-09'
Description: API Gateway (GET) → Step Functions (Express) with CloudWatch Logs
Resources:
  StepFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/vendedlogs/states/${AWS::StackName}-statemachine"
      RetentionInDays: 7
  StepFunctionsExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "StepFunctions-${AWS::StackName}-role"
      Path: /service-role/
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: states.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Policies:
        - PolicyName: AllowStepFunctionsLogs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:*
                Resource: "*"
  MyStateMachine:
    Type: AWS::StepFunctions::StateMachine
    DependsOn: StepFunctionLogGroup
    Properties:
      StateMachineName: !Sub "${AWS::StackName}-MyStateMachine"
      StateMachineType: EXPRESS
      RoleArn: !GetAtt StepFunctionsExecutionRole.Arn
      LoggingConfiguration:
        Destinations:
          - CloudWatchLogsLogGroup:
              LogGroupArn: !GetAtt StepFunctionLogGroup.Arn
        IncludeExecutionData: true
        Level: ALL
      DefinitionString: |
        {
          "StartAt": "HelloWorld",
          "States": {
            "HelloWorld": {
              "Type": "Pass",
              "Result": {
                "message": "Hello from Step Functions!"
              },
              "End": true
            }
          }
        }
  # API Gateway 実行ロール（Step Functions実行権限）
  ApiGatewayExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: apigateway.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AllowStepFunctionsStart
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: states:StartSyncExecution
                Resource: !Ref MyStateMachine
  # API Gateway 本体
  MyApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: StepFunctionsApi
  MyResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt MyApi.RootResourceId
      PathPart: start
      RestApiId: !Ref MyApi
  MyMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: GET
      ResourceId: !Ref MyResource
      RestApiId: !Ref MyApi
      AuthorizationType: NONE
      Integration:
        Type: AWS
        IntegrationHttpMethod: POST
        Uri: !Sub >-
          arn:aws:apigateway:${AWS::Region}:states:action/StartSyncExecution
        Credentials: !GetAtt ApiGatewayExecutionRole.Arn
        RequestTemplates:
          application/json: !Sub |
            #set($data='{"param":"'+$input.params('param')+'"}')
            #set($data=$util.escapeJavaScript($data))
            {
              "input" :"$data",
              "stateMachineArn": "${MyStateMachine}"
            }
        IntegrationResponses:
          - StatusCode: 200
            ResponseTemplates:
              application/json: "$input.body"
      RequestParameters:
        method.request.querystring.example: false
      MethodResponses:
        - StatusCode: 200
  MyDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn: MyMethod
    Properties:
      RestApiId: !Ref MyApi
      StageName: prod
Outputs:
  ApiEndpoint:
    Description: API Endpoint to start Step Functions (GET /start?example=value)
    Value: !Sub "https://${MyApi}.execute-api.${AWS::Region}.amazonaws.com/prod/start?example=value"