A better Step Functions console, in your own AWS account.
Cloud Certainty StateCraft gives your engineers one place to watch, search, fix and design AWS Step Functions workflows across your AWS accounts and Regions: every execution state by state, with its timeline and full event history, failures found and redriven in bulk, and a visual designer you can drive with the mouse, the keyboard or your voice. You decide who may see, run or deploy which state machines, and AWS enforces it. It runs entirely in your AWS account, and nothing leaves it.
ONE CLOUDFORMATION STACK · YOUR ACCOUNT · YOUR IDP · EARLY ACCESS · PLANNED FROM $100 A MONTH
Not on AWS Marketplace yet. Early access by email: [email protected].
[ A ] WHAT THE STEP FUNCTIONS CONSOLE LACKS, AND WHAT STATECRAFT ADDS
The Step Functions console shows one execution of one state machine in one Region. Teams that run workflows in production end up paging through event histories 25 at a time, redriving failures one by one, keeping definitions in wikis and writing IAM policies person by person. StateCraft covers the gaps and keeps everything in your account.
Overview
The Step Functions console:One Region at a time, one state machine at a time.
StateCraft:A fleet view of every state machine across your accounts and Regions, with executions, failures, success rate, p50 and p95 duration and a sparkline from CloudWatch, for the last hour, day, week or 30 days.
Event history
The Step Functions console:25 events per page, and a graph that shows where an execution ended, not where its time went.
StateCraft:The full history, 1,000 events at a time up to the 25,000-event limit, with filters, search, a compact view and a warning near the limit. A live graph with each state’s status and a timeline with every retry and lanes for Map iterations and Parallel branches.
Distributed Map
The Step Functions console:Child executions found only by their exact name, and no grouping of failures.
StateCraft:A Map Run explorer: progress, child executions by status, failure clusters by error and cause, and live changes to max concurrency and tolerated failures while the Map Run is running.
Finding failures
The Step Functions console:Per state machine, by status and name.
StateCraft:Search up to 200 state machines at once by status, time range and name prefix, with failure clusters and links that share the view with a colleague.
Fixing failures
The Step Functions console:Redrive one execution at a time, and work out for yourself whether it still can be.
StateCraft:A redrive helper that says whether an execution can be redriven, why not, and how much of the 14 days is left; start again with the same input; and compare two executions side by side.
Bulk actions
The Step Functions console:None. StopExecution takes one execution at a time.
StateCraft:Stop, redrive or re-run up to 500 executions in one job, carried out by StateCraft’s own Step Functions workflow in your account, as you, with your grants checked again for every item. Team and above
Express workflows
The Step Functions console:CloudWatch Logs Insights queries, the last 3 hours by default, billed per scan.
StateCraft:Express executions with their history and graph, read from the state machine’s log group, up to 7 days per view.
Cost
The Step Functions console:Transition counts and usage per account and machine, but no dollars per execution.
StateCraft:The estimated cost of every execution, from its state transitions or its requests and duration, at the prices your administrator sets.
Designing
The Step Functions console:Workflow Studio, with no autosave and no IAM policy for SDK integrations.
StateCraft:Autosaved drafts with versions, a two-way code view, lint with quick fixes, TestState with mocks, a JSONata playground and templates. Deploy with versions and canary aliases, or export to CloudFormation, SAM, CDK or Terraform with a generated IAM policy.
Voice
The Step Functions console:No way to build a workflow by speaking or typing what you want.
StateCraft:Spoken or typed commands that build and change the workflow, each shown in the graph and the code at once and undoable. Audio goes to Amazon Transcribe in your account and is never stored.
Assist
The Step Functions console:Amazon Q explains a failure; it doesn’t build or change a workflow.
StateCraft:Describe a workflow or a change, and Claude on Amazon Bedrock in your account proposes it as a validated diff you accept or reject. Nothing is applied or deployed without you. Business and above
Who did it
The Step Functions console:Not recorded. CloudTrail shows the IAM role.
StateCraft:Execution records of who started, stopped, redrove or re-ran what, and the user’s email as the source identity of every AWS session, so CloudTrail names the person.
Access
The Step Functions console:IAM policies written by hand, person by person, and no way to show an execution without its data.
StateCraft:Grants per user or group: view, data, run or deploy on state machine patterns such as “orders-*”, per account and Region. AWS enforces them through a session policy on every request.
[ B ] WHAT YOUR ENGINEERS GET
Find a failure, see why it happened and fix it, without AWS console access. Users see only the state machines they are granted, inputs and outputs only with the data permission, and actions they may not take are greyed out with the reason.
- Fleet
- Every state machine you may view, in every account and Region, with started, failed, timed out, aborted and throttled executions, redrives, success rate and duration percentiles. Sort by failures to see what is on fire.
- Graph
- The definition the execution actually ran, with each state’s status, attempts, Map iterations and Parallel branches. Running executions update live.
- Timeline
- A Gantt chart of every state, with each retry as its own bar and lanes for Map iterations and Parallel branches, so you see where the time went.
- Events
- The full event history up to 25,000 events, filtered by type, state or failures, searched, compacted to one line per state, or downloaded as JSON.
- Map Runs
- Progress, child executions by status, failure clusters, and with run permission, the max concurrency and tolerated failures changed while it runs.
- Compare and cost
- Two executions side by side, with the states each took and their timings. The estimated cost of every execution.
- Stop and redrive
- Stop, redrive with the helper’s 14-day countdown, or start again with the same input, each recorded with your name.
- Search
- Executions across up to 200 state machines at once, with failure clusters and shareable links. Bulk stop, redrive and re-run on Team and above.
- State machine orders-processing · eu-west-1
- Alias live → version 8
- Status Failed
- Failed at Charge card · 3 attempts
- Estimated cost 14 transitions · $0.00035
- Started by [email protected]
[ C ] DESIGN BY MOUSE, KEYBOARD OR VOICE
A palette of states and service integrations, forms for every field in JSONata and JSONPath, a Choice rule builder, Retry and Catch editors and a two-way code view. Or say what you want: the microphone and the command field take the same commands, and each one changes the draft where you can see it.
- “add a Lambda task called Charge card after Validate order”
- Inserts a Lambda task named Charge card after Validate order
- “if amount is greater than 100 go to Manual review otherwise go to Approve”
- Adds a Choice with that rule and default
- “retry 3 times with backoff”
- Adds a Retry with 3 attempts and exponential backoff to the selected state
- “for each item in items run Process item”
- Adds a Map over items that runs Process item
- “undo”
- Reverts the last change, whether it came from a command, the mouse or the keyboard
- “deploy”
- Opens the deploy dialog, which still needs your confirmation
- Commands are a fixed grammar, not a model: the same words always make the same change, shown at once in the graph and the code, and “undo” takes it back
- Speech goes from your browser to Amazon Transcribe in your account, through a link signed for you for 5 minutes. StateCraft stores no audio and no transcripts
- Lint with quick fixes as you edit, ValidateStateMachineDefinition before deploy, and TestState on any state, with mocks, before it touches production
- On Business and above, describe a workflow and Claude on Amazon Bedrock in your account proposes it as a diff you accept or reject
"Charge card": {
"Type": "Task",
"Resource": "arn:aws:states:::lambda:invoke",
"Arguments": {
"FunctionName": "charge-card",
"Payload": "{% $states.input %}"
},
"Retry": [
{
"ErrorEquals": ["States.ALL"],
"IntervalSeconds": 1,
"MaxAttempts": 3,
"BackoffRate": 2
}
],
"Next": "Send confirmation"
}[ D ] WHAT ADMINISTRATORS CONTROL
Connections
This account from the start; other accounts through a spoke role with an external ID, one by one or across an AWS Organization with a StackSet. Each role has an access level, Read, Operate or Full, that StateCraft can never exceed.
Grants
view, data, run and deploy for users and groups from your identity provider, on state machine name patterns, per connection and Region. Seeing inputs and outputs is its own permission.
Enforced by AWS
The API checks every grant, and every AWS call runs with credentials a session policy limits to the granted state machines, their executions, versions, aliases and Map Runs. A grant that would not fit is refused, never widened.
Voice and assist
Choose how speech becomes text: Amazon Transcribe in your account, the browser’s speech service, or off. On Business and above, turn on assist with the Claude model on Amazon Bedrock you choose.
Usage and records
Starts, stops, redrives, deploys, TestState runs, bulk items, voice sessions and assist requests per day, and per user on Business and above. Who started, stopped or redrove each execution.
Audit log and settings
Roles, connections, grants, settings, deploys, versions, aliases, executions and Map Run changes, with the person and source IP. The IP allowlist on Business and above, and the Step Functions prices used for cost.
[ E ] SECURITY
Nothing leaves your account
Your state machines and executions stay in Step Functions, and everything StateCraft stores is in DynamoDB in your account. Cloud Certainty runs no service in the data path, and StateCraft sends no telemetry. The one outbound request is an optional daily read of a public release manifest.
Least privilege, twice
Users see no state machine until they are granted one. The API checks the grant, then AWS enforces it again through a per-request session policy on Step Functions.
Data apart from metadata
Without the data permission, StateCraft asks Step Functions for metadata only and removes inputs, outputs and causes. For state machines encrypted with your KMS key, the user’s session can’t decrypt them either.
Voice and assist stay in your account
Audio goes from the browser to Amazon Transcribe in your account through a link signed for one person for 5 minutes, and is never stored. Assist uses Amazon Bedrock in your account. Neither changes a workflow you haven’t seen, and neither deploys.
Audit
CloudTrail names the person on every AWS call StateCraft makes, and the audit log keeps deploys, starts, stops, redrives, Map Run changes, TestState runs and administrative changes for 30 days to 10 years by plan.
The security overview has the threat model, the IAM roles, the data flows for voice and assist, and the shared responsibility a security review needs.
[ F ] RUNS IN YOUR ACCOUNT, FROM LAUNCH TO THE FIRST EXECUTION
- 01
Deploy
Launch one CloudFormation stack in your own account and Region. It is serverless, so it costs close to nothing while nobody is using it.
Stays in your account
Drafts, saved inputs, execution records, bulk jobs, the cache and the audit log are in DynamoDB in your account. Nothing is sent to Cloud Certainty.
Licensed through AWS
The licence is read from AWS License Manager in your own account. Nothing phones home.
- 02
Sign in
Users sign in through Amazon Cognito with MFA or AWS IAM Identity Center on every plan, or your own SAML or OIDC provider, such as Microsoft Entra ID or Okta, on Team and above.
Only trusted identities
Roles and grants follow the user’s email, so StateCraft accepts only emails your directory asserts or has verified.
- 03
Connect accounts
State machines in this account are there from the start. Reach other accounts through a small IAM role you deploy in each, at the access level you choose.
The role is the ceiling
Read only looks. Operate, the default, adds starting, stopping and redriving. Only Full can deploy, and it passes only the execution roles you list.
- 04
Grant and run
Give teams view, data, run or deploy on their state machines. They follow executions, fix failures and design workflows without AWS console access.
Scoped on every request
Each AWS call runs with credentials that last 15 minutes, narrowed by a session policy to the user’s grants.
Every action traced
The user’s email is the source identity of every session, so CloudTrail names the person.
One stack: a serverless API (API Gateway and Lambda), the web app on Amplify Hosting, Amazon Cognito sign-in, DynamoDB, and StateCraft’s own Step Functions workflow for bulk jobs. The installation guide lists every parameter.
[ G ] PLANS AND PRICING
The pricing planned for the AWS Marketplace launch: contract pricing, monthly or 12 months up front. Plans are not priced per user, per state machine or per execution: everyone in your organisation can use StateCraft. Prices in US dollars, billed through your AWS bill.
Starter
For a small team that needs a better execution explorer, the voice and visual designer, and private drafts.
- AWS accounts
- 3
- Drafts per user
- 25
- Saved inputs per user
- 50
- Versions kept per draft
- 5
- Execution records and bulk jobs kept
- 30 days
Team
Adds shared drafts and inputs, bulk stop, redrive and re-run, and your own SAML or OIDC sign-in.
- AWS accounts
- 10
- Drafts per user
- 250
- Saved inputs per user
- 500
- Versions kept per draft
- 25
- Execution records and bulk jobs kept
- 90 days
Business
Adds governance and assist: usage per user, the IP allowlist, and workflows drafted from a description by Claude on Amazon Bedrock in your account.
- AWS accounts
- 50
- Drafts per user
- 1,000
- Saved inputs per user
- 2,000
- Versions kept per draft
- 50
- Execution records and bulk jobs kept
- 365 days
Enterprise
Everything in Business, with the highest limits and two years of execution records.
- AWS accounts
- Unlimited
- Drafts per user
- Unlimited
- Saved inputs per user
- Unlimited
- Versions kept per draft
- 100
- Execution records and bulk jobs kept
- 730 days
| Feature | Starter | Team | Business | Enterprise |
|---|---|---|---|---|
| Per month | $100 | $250 | $1,000 | $2,500 |
| 12 months | $1,000 | $2,500 | $10,000 | $25,000 |
| AWS accounts | 3 | 10 | 50 | Unlimited |
| Drafts per user | 25 | 250 | 1,000 | Unlimited |
| Saved inputs per user | 50 | 500 | 2,000 | Unlimited |
| Versions kept per draft | 5 | 25 | 50 | 100 |
| Execution records and bulk jobs kept | 30 days | 90 days | 365 days | 730 days |
| Audit log kept | 30 days | 90 days | 365 days | 3,650 days |
| Executions per bulk job | No bulk jobs | 100 | 250 | 500 |
| Shared drafts and saved inputs | Not included | Included | Included | Included |
| Bulk stop, redrive and re-run, carried out by a Step Functions workflow in your account | Not included | Included | Included | Included |
| SAML and OIDC identity providers, such as Microsoft Entra ID and Okta | Not included | Included | Included | Included |
| IP allowlist on every API call | Not included | Not included | Included | Included |
| Usage per user | Not included | Not included | Included | Included |
| Workflows drafted from a description by Claude on Amazon Bedrock, in your account | Not included | Not included | Included | Included |
Every plan includes
- Fleet view of every state machine across accounts and Regions, with executions, failures, success rate and p95 duration
- Execution explorer: a live graph with the status of every state, retries and Map iterations, and a timeline of the whole run
- The full event history, up to the 25,000-event limit, with filters, search and a compact view
- Map Run explorer: progress, child executions, failure clusters, and live changes to concurrency and failure tolerance
- Express executions read from CloudWatch Logs, compare two executions, cost per execution and a redrive helper
- Executions search across state machines, with shareable views
- A visual designer with a two-way code view, validation, TestState, a JSONata playground and templates
- Voice and typed commands that build and edit workflows, with every change shown and undoable
- Private drafts with versions, deployment with versions and aliases, and export to CloudFormation, SAM, CDK and Terraform
- Grants per user or group on state machines, enforced by AWS session policies, with the user’s email in CloudTrail
- Connections to other AWS accounts, execution records, daily usage totals, an audit log, Amazon Cognito sign-in with MFA and IAM Identity Center
Pricing for the launch
StateCraft is in early access and not on AWS Marketplace yet. These are the plans and prices planned for the launch. Until then, ask for early access.
Business and Enterprise are add-ons
On the StateCraft listing, Team is the base plan. Business is Team plus the Business add-on ($750 a month or $7,500 for 12 months), and Enterprise adds the Enterprise add-on to both ($1,500 a month or $15,000 for 12 months). An add-on on its own grants nothing. Starter is a separate listing, StateCraft Starter.
Step Functions is billed by AWS
Your executions are billed by Step Functions as usual, exactly as when you start them in the console; looking at them starts nothing. Amazon Transcribe bills voice by the second and Amazon Bedrock bills assist by the token, only when they are used. Lambda, API Gateway, DynamoDB and Cognito cost pennies a month for a team.
Support
Basic support is included. Paid plans with response times, and a fixed-price installation service, are on the support page. Questions about plans: [email protected].
[ H ] QUESTIONS
- Can I use StateCraft today?
- It is in early access. It is not on AWS Marketplace yet; email us about your AWS setup and we will set you up ahead of the launch.
- Does any data leave my AWS account?
- No. The stack runs in your account and calls AWS only. Everything StateCraft stores is in DynamoDB in your account, voice uses Amazon Transcribe there, and the licence is read from AWS License Manager there.
- Can it change my workflows?
- Only if you let it. The default Operate access level allows starting, stopping and redriving executions; deploying needs a Full connection and a deploy grant. A voice command or an assist proposal changes only your draft, where you see it, and every deploy is audited.
- What does it cost to run?
- The licence is a monthly or 12-month contract. Step Functions bills your executions as usual, and Amazon Transcribe and Amazon Bedrock bill voice and assist when you use them. Lambda, API Gateway, DynamoDB and Cognito cost pennies a month for a team.
More in the FAQ, including how StateCraft compares with the Step Functions console and observability tools, and the documentation.
Amazon Web Services, AWS, AWS Step Functions, Amazon Transcribe, Amazon Bedrock, AWS CloudTrail and AWS Marketplace are trademarks of Amazon.com, Inc. or its affiliates. Claude is a trademark of Anthropic, PBC. Terraform is a trademark of HashiCorp, Inc. StateCraft is a product of Cloud Certainty OÜ and is not affiliated with or endorsed by Amazon.