main.tf

###############################################################################
# Local computation
###############################################################################

locals {
 # encryption_configuration.type is Required by the AWS API even though the
 # provider marks it Optional; the module always renders the block and
 # derives the discriminator from kms_key_arn presence, mirroring the
 # AWS-managed-vs-customer-managed pattern used across every encryption
 # variable. AWS_OWNED_KEY is the authoritative "no CMK" value per the shared
 # EncryptionConfiguration API type used by both CreateStateMachine and
 # CreateActivity (see main.tf provider-gotcha note on aws_sfn_activity below).
 encryption_type = var.kms_key_arn != null ? "CUSTOMER_MANAGED_KMS_KEY": "AWS_OWNED_KEY"

 # Step Functions requires the log destination ARN to end in ":*"; normalize
 # so callers can supply the bare log group ARN whether or not they already
 # included the suffix (idempotent trim-then-append).
 log_destination = var.log_destination_arn != null ? "${trimsuffix(var.log_destination_arn, ":*")}:*": null

 # Whether any timeouts value was supplied (the object defaults to {}).
 timeouts_set = length([for v in values(var.timeouts): v if v != null]) > 0
}

###############################################################################
# Step Functions state machine (keystone)
###############################################################################

resource "aws_sfn_state_machine" "this" {
 name = var.name
 name_prefix = var.name_prefix
 role_arn = var.role_arn
 definition = var.definition
 type = var.type
 publish = var.publish

 # Encryption at rest is unconditional — Step Functions always encrypts data;
 # this block only chooses which key layer sits on top (AWS-owned vs CMK).
 encryption_configuration {
 kms_key_id = var.kms_key_arn
 type = local.encryption_type
 kms_data_key_reuse_period_seconds = var.kms_key_arn != null ? var.kms_data_key_reuse_period_seconds: null
 }

 dynamic "logging_configuration" {
 for_each = var.enable_logging ? [1]: []
 content {
 log_destination = local.log_destination
 include_execution_data = var.logging_include_execution_data
 level = var.logging_level
 }
 }

 dynamic "tracing_configuration" {
 for_each = var.enable_tracing ? [1]: []
 content {
 enabled = true
 }
 }

 dynamic "timeouts" {
 for_each = local.timeouts_set ? [var.timeouts]: []
 content {
 create = try(timeouts.value.create, null)
 update = try(timeouts.value.update, null)
 delete = try(timeouts.value.delete, null)
 }
 }

 tags = var.tags
}

###############################################################################
# Activities (long-polled workers) — for_each over caller-keyed map
#
# STANDARD-only: pairing these with an EXPRESS state machine (var.type) fails
# at execution time, not plan/apply time — see the activities variable
# description. Not linked to aws_sfn_state_machine.this by any provider-level
# reference; the caller wires each activity's arn output into the ASL
# definition string before the state machine is created.
###############################################################################

resource "aws_sfn_activity" "this" {
 for_each = var.activities

 name = coalesce(try(each.value.name, null), each.key)

 # NOTE: the aws_sfn_activity registry documentation lists AWS_KMS_KEY as the
 # non-CMK encryption_configuration.type value, but the AWS API's shared
 # EncryptionConfiguration type (used by both CreateStateMachine and
 # CreateActivity) documents AWS_OWNED_KEY as the only non-CMK value — this
 # module uses AWS_OWNED_KEY consistently for both resources (see SCOPE.md
 # Provider gotchas).
 encryption_configuration {
 kms_key_id = try(each.value.kms_key_arn, null)
 type = try(each.value.kms_key_arn, null) != null ? "CUSTOMER_MANAGED_KMS_KEY": "AWS_OWNED_KEY"
 kms_data_key_reuse_period_seconds = try(each.value.kms_key_arn, null) != null ? try(each.value.kms_data_key_reuse_period_seconds, null): null
 }

 tags = merge(var.tags, try(each.value.tags, {}))
}