// ExposedKeyStepFunction
resource "aws_sfn_state_machine" "exposed_key_step_function" {
  # checkov:skip=CKV_AWS_284:Ensure State Machine has X-Ray tracing enabled
  name     = local.name_prefix
  role_arn = aws_iam_role.step_function_execution_role.arn

  definition = <<EOF
{
  "Comment": "Deletes exposed IAM access keypairs and notifies security",
  "StartAt": "DeleteAccessKeyPair",
  "States": {
    "DeleteAccessKeyPair": {
      "Type": "Task",
      "Resource": "${aws_lambda_function.delete_access_key_pair_lambda.arn}",
      "Catch": [
        {
          "ErrorEquals": [ "ClientError" ],
          "ResultPath": "$.error-info",
          "Next": "NotifySecurity"
        }
      ],
      "Next": "LookupCloudTrailEvents"
    },
    "LookupCloudTrailEvents": {
      "Type": "Task",
      "Resource": "${aws_lambda_function.lookup_cloudtrail_events_lambda.arn}",
      "Next": "NotifySecurity"
    },
    "NotifySecurity": {
      "Type": "Task",
      "Resource": "${aws_lambda_function.notify_security_lambda.arn}",
      "End": true
    }
  }
}
EOF
}