StepFunctions not getting permission on Redshift schema

I'm developing a simple StepFunction state machine that calls a Redshift procedure and, when completed, calls a Lambda function. I created an IAM Role for the StepFunction state machine which contains "AmazonRedshiftDataFullAccess" and, later on, a custom permission that grants all Redshift actions.

Nonetheless, when execution the state machine and calling DescribeStatement, I always get the same error:

"Error": "ERROR: permission denied for schema mis",

What is not clear to me is: should the IAM permissions be enough to call a Redshift procedure on any schema? Do I have to grant any additional permission directly on Redshift to allow this IAM Role to have the necessary rights?

State machine:

Defitinion of ExecuteStatement step:

{
  "Type": "Task",
  "Parameters": {
    "ClusterIdentifier": "redshift-cluster",
    "Database": "prod",
    "Sql": "CALL mis.myproc();"
  },
  "Resource": "arn:aws:states:::aws-sdk:redshiftdata:executeStatement",
  "TimeoutSeconds": 1200,
  "Next": "Wait"
}

Output of ExecuteStatement step:

{
  "ClusterIdentifier": "redshift-cluster",
  "CreatedAt": "2023-07-17T23:44:19.840Z",
  "Database": "prod",
  "DbUser": "IAMR:StepFunctions-stepfunc-load-arvore-distribuicao-role-eed3bb05",
  "Id": "b47c89f9-ffba-4620-b027-f59e6cbb095c"
}

Output of DescribeStatement step:

{
  "ClusterIdentifier": "redshift-cluster",
  "CreatedAt": "2023-07-17T23:44:19.840Z",
  "Duration": -1,
  "Error": "ERROR: permission denied for schema mis",
  "HasResultSet": false,
  "Id": "b47c89f9-ffba-4620-b027-f59e6cbb095c",
  "QueryString": "CALL mis.proc_arvore_decisao_join();",
  "RedshiftPid": 1073742125,
  "RedshiftQueryId": -1,
  "ResultRows": -1,
  "ResultSize": -1,
  "Status": "FAILED",
  "UpdatedAt": "2023-07-17T23:44:20.981Z"
}

I understand that with AmazonRedshiftDataFullAccess the state machine should be able to "create" a user on the fly and access Redshift resources. What am I missing?

Update 1: I found out a need a redshift_data_api_user user created in Redshift in order to redshift:GetClusterCredentials work with AmazonRedshiftDataFullAcess, as it defines this username. Created the user (disabled password) with USAGE and EXECUTE grants in Redshift, but the same error remains.

So, after some digging I got this working. Relevant points to take into consideration:

• With AmazonRedshiftDataFullAccess policy attached to the Step Functions State Machine, StepFunctions will create a user in Redshift cluster ("IAMR:<role-name>") by default. One way to solve the problem is giving this user the appropriate permissions directly in Redshift. Important to note that the role name can be overriden using the RedshiftDbUser tag in the role associated with the state machine, in which case the name will become "IAMR:<tag-value>"
• Another possibility (the one I used) is to define in the Redshift ExecuteStatement step a DbUser property. A policy that allows GetClusterCredentials from Redshift to the specified user must be present so Temporary Credentials can be created to it. By default, policy AmazonRedshiftFullDataAccess includes redshift_data_api_user in the GetClusterCredentials. If you want to use another username you need to create a custom policy (and assure there is a Redshift user with proper permissions).

Hope this helps!