Frequently asked questions

#What is StateCraft?

Cloud Certainty StateCraft is a better AWS Step Functions console, with a visual and voice workflow designer, and it runs entirely in your own AWS account. Your teams see every state machine across accounts and Regions, follow each execution state by state with its full event history, search and bulk-redrive failures, and design, test and deploy workflows by mouse, keyboard or voice. Administrators grant users and groups access per state machine pattern, AWS enforces every grant, and an audit log and execution records show who did what. You install it with one CloudFormation stack, and no data leaves your account.

#Pricing

#How much does it cost?

StateCraft is sold on AWS Marketplace with contract pricing: pay monthly, or for 12 months up front.

Prices are in US dollars and billed through your AWS bill. Plans are not priced per user, per state machine or per execution: everyone in your organisation can use StateCraft.

#Why do Business and Enterprise appear as add-ons?

On the StateCraft listing, Team is the base plan and Business and Enterprise are add-ons to it. For Business, choose Team and the Business add-on; for Enterprise, choose all three. A plan counts only when every plan below it is in the contract too, so an add-on bought on its own grants nothing. Starter is a separate listing, StateCraft Starter.

#What else do I pay for?

Step Functions itself, and the AWS resources the stack uses in your account, are billed to you by AWS as usual. StateCraft is serverless, so it costs close to nothing while nobody is using it.

#What happens when the contract ends?

StateCraft keeps working on the last plan for up to 72 hours, then every page says a licence is required and only the licence page works for administrators. All data (drafts, saved inputs, execution records, the audit log) stays in your account, and subscribing again unlocks it. Your state machines keep running in Step Functions either way. The same 72 hours cover a brief outage of AWS License Manager.

#Plans

#What does each plan include?

• Every plan has the fleet view, the execution explorer (graph, timeline, full history, Map Run explorer, compare, cost, redrive helper), Express executions, cross-machine search, starting, stopping and redriving executions, the designer with TestState, deploy and export, voice and typed commands, private drafts and saved inputs, connections to other accounts, grants, execution records, daily usage, the audit log, and IAM Identity Center and Cognito sign-in with MFA.
• Team adds shared drafts and saved inputs, bulk stop, redrive and re-run jobs, and SAML and OIDC identity providers.
• Business adds assist (Claude on Amazon Bedrock in your account), usage per user and the IP allowlist.
• Enterprise has the Business features with the highest limits.

#How are AWS accounts counted?

Each distinct AWS account among your connections counts once, the hub account included. A connection can cover many Regions of its account at no extra count. When all are in use, new accounts can't be connected; accounts already connected keep working.

#Deployment

#Which AWS Regions are supported?

Any Region with AWS Step Functions, AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate, for example us-east-1, eu-west-1, eu-west-2, eu-central-1 and ap-southeast-2. Voice also needs Amazon Transcribe streaming in the stack's Region, and assist needs the Claude model on Amazon Bedrock in the Region you choose. The same template URL works in every Region. The Region you deploy to doesn't limit which Regions you can work in: the stack's LocalRegions parameter and each connection list the Regions to show.

#How do I install it?

Subscribe on AWS Marketplace and launch one CloudFormation stack in the account that subscribed. Creation takes about 10 minutes. See Getting started and the installation guide.

#Does anything run in my VPC?

Only a one-off installer task, for about a minute at install and at each upgrade. It needs outbound HTTPS. Nothing accepts inbound connections, and the rest of the stack is serverless.

#Does it work with many AWS accounts?

Yes. Deploy the spoke role template in each account, or across an AWS Organization with a StackSet. StateCraft assumes that role with an external ID, and the role's access level (Read, Operate or Full) is the upper limit of what it can do there. See Deploy the spoke role in other accounts.

#Which identity providers work?

Amazon Cognito users (with required MFA) and AWS IAM Identity Center on every plan. Other SAML 2.0 providers, such as Microsoft Entra ID and Okta, and OIDC providers on Team and above. See Identity providers.

#Does it work with Express workflows?

Yes, through their CloudWatch Logs: Step Functions has no API that lists Express executions or returns their history, so StateCraft reads them from the state machine's log group. Turn on logging at level ALL (with execution data if people should see inputs and outputs). Express executions can't be stopped or redriven; Step Functions doesn't allow it.

#Data and security

#Does any data leave my account?

No. Your state machines and executions stay in Step Functions, and everything StateCraft stores (connections, grants, drafts, saved inputs, execution records, bulk jobs, the cache and the audit log) is in DynamoDB in your account. Cloud Certainty runs no service in the data path, and StateCraft sends no telemetry. The licence check is a read from AWS License Manager in your own account. The only outbound request to us is the optional daily read of a public release manifest, which sends nothing about you; set UpdateChecks to Disabled to turn it off. See the security overview.

#Where does my voice go?

By default, from your browser straight to Amazon Transcribe in your organisation's AWS account, through a link StateCraft signs for you that lasts 5 minutes. StateCraft never stores audio or what you said. An administrator can choose the browser's own speech service instead; in Chrome and Edge that sends audio to the browser vendor, outside your AWS account, and the portal says so. Or they can turn the microphone off: every command can also be typed.

#Does assist send my workflows to an AI vendor?

No. Assist calls Claude on Amazon Bedrock in your own AWS account, in the Region you choose, with only the description you type and, for a change, the current definition. It is a Business feature, off until an administrator turns it on. Its proposals are shown as a diff and applied only when you accept them; it never deploys anything.

#Can users only see what they are granted?

Yes. Users see no state machines until an administrator grants them access, by name pattern, per account and Region. Each request runs with short-lived AWS credentials that a session policy limits to the user's grants, so AWS itself refuses a call on a state machine the user may not use. Seeing execution inputs and outputs is a separate permission (data). See Identity and authorization.

#Who started this execution?

Step Functions doesn't record it. For every execution started, stopped, redriven or re-run through StateCraft, StateCraft records who did it, shows it on the execution, and lists it day by day for administrators. In CloudTrail, every Step Functions call StateCraft makes carries the user's email as its sourceIdentity, and the role session is named sc-<email>.

#Can StateCraft change my workflows?

Only if you let it. The access level of each account sets the limit: Read allows looking only; Operate (the default) adds starting, stopping and redriving executions; Full adds deploying changes to state machines. On top of that, each person needs a grant with run or deploy on that state machine, and every change is recorded in the audit log.

#How does it compare?

#Why not the Step Functions console?

StateCraft doesn't replace the AWS console for every task, but it covers what teams miss there:

#Why not Datadog or another observability tool?

Observability tools are good at alerting and tracing across services, and they send your execution data to their service. StateCraft is a console: it reads Step Functions directly, as the person, in your account, and it also runs, fixes and designs workflows, which monitoring tools don't.

#Can it build a workflow from a description?

Yes, on Business and above, with assist: describe the workflow and Claude on Amazon Bedrock in your account proposes it as a diff you accept or reject. On every plan you can also build and change workflows with spoken or typed commands such as "add a Lambda task called Charge card after Validate order".

#Can I search executions by their input?

Not yet. This release searches by state machine, status, time range and name prefix. Search by input, output or a business key, through an execution index in your account, is on the roadmap.

#Upgrades

#How do I install a new release?

Each release is a new template. Update the stack with the new template URL and keep your parameter values. Administrators see a banner when a new release is out. See the upgrading guide and the release notes.

#How do I change plan?

Email [email protected]: we prepare an AWS Marketplace offer that credits the rest of your current contract. Between Team, Business and Enterprise no stack update is needed: the new limits and features apply when the new contract is active, and StateCraft keeps working on your current plan for up to 72 hours while the agreement changes. Your drafts, saved inputs, records and settings stay as they are. See Changing plan.

#Support

#How do I get help?

Basic support is included: email [email protected] with your stack's Region, the release you run (the ProductVersion stack output) and what you see. We respond within one business day. Paid support plans with response times are on the support page.

#Does Cloud Certainty have access to my account?

No. We have no access to your account and StateCraft doesn't give us any. When you ask for help, you share what you choose, such as an error message or an execution ARN.