Fix/sfn state machine hang

[AndrewCharlesHay]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No changes to security controls.

Description

We cap the retry wait time for AccessDeniedException inside aws_sfn_state_machine creation to a maximum of 2 minutes. Previously, it would catch an AccessDeniedException (often thrown when CloudWatch Logs permissions are absent) and retry endlessly up to the full resource timeout (e.g., 5-30 minutes). Now, it safely waits up to 2 minutes for IAM eventual consistency propagation without hanging indefinitely for entirely missing permissions.

Relations

Relates #7893

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

⚠️ Our automation has detected the following potential issues with your pull request

---

❌ Changelog Entry Required (Click to expand)

The proposed change requires a changelog entry. Please see the Changelog Process section of the contributing guide for information on the changelog generation process.

Tip: This check is not triggered for draft pull requests, since the pull request number is not known until the pull request is opened and is required to create a changelog entry. Opening a pull request first as a draft, adding the requisite changelog entry file, and then marking the pull request as ready for review will prevent future warnings.

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.