From 216b8d5516d13fd5c7d64464baadf45a6ea3c2e3 Mon Sep 17 00:00:00 2001
From: Tal Usvyatsky <tal.usvyatsky@datadoghq.com>
Date: Tue, 20 Oct 2026 17:24:13 -0400
Subject: [PATCH] chore: update step_functions_python_stack snapshot for
 aws-cdk-lib 2.274.0

aws-cdk-lib 2.274.0 adds aws:SourceArn and aws:SourceAccount conditions
to the trust policy of Step Functions roles. The Python integration stacks
get the latest aws-cdk-lib 2.x through the construct dependency, so the
snapshot no longer matches.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 ...-step_functions_python_stack-snapshot.json | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/integration_tests/snapshots/correct-step_functions_python_stack-snapshot.json b/integration_tests/snapshots/correct-step_functions_python_stack-snapshot.json
index f3d09e88a..864a18364 100644
--- a/integration_tests/snapshots/correct-step_functions_python_stack-snapshot.json
+++ b/integration_tests/snapshots/correct-step_functions_python_stack-snapshot.json
@@ -7,6 +7,35 @@
      "Statement": [
       {
        "Action": "sts:AssumeRole",
+       "Condition": {
+        "ArnLike": {
+         "aws:SourceArn": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:",
+            {
+             "Ref": "AWS::Partition"
+            },
+            ":states:",
+            {
+             "Ref": "AWS::Region"
+            },
+            ":",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":stateMachine:*"
+           ]
+          ]
+         }
+        },
+        "StringEquals": {
+         "aws:SourceAccount": {
+          "Ref": "AWS::AccountId"
+         }
+        }
+       },
        "Effect": "Allow",
        "Principal": {
         "Service": "states.amazonaws.com"
@@ -331,6 +360,35 @@
      "Statement": [
       {
        "Action": "sts:AssumeRole",
+       "Condition": {
+        "ArnLike": {
+         "aws:SourceArn": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:",
+            {
+             "Ref": "AWS::Partition"
+            },
+            ":states:",
+            {
+             "Ref": "AWS::Region"
+            },
+            ":",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":stateMachine:*"
+           ]
+          ]
+         }
+        },
+        "StringEquals": {
+         "aws:SourceAccount": {
+          "Ref": "AWS::AccountId"
+         }
+        }
+       },
        "Effect": "Allow",
        "Principal": {
         "Service": "states.amazonaws.com"