Create an IAM role for AWS FIS experiments
AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. To use AWS FIS, you must create an IAM role that grants AWS FIS the permissions required so that AWS FIS can run experiments on your behalf. You specify this experiment role when you create an experiment template. The IAM policy for the experiment role must grant permission to modify the resources that you specify as targets in your experiment template.
As a best practice, we recommend that you follow the standard security practice of granting least privilege. You can do so by specifying specific resource ARNs or tags in your policies.
Create an experiment role using the AWS CLI
Use the following procedure to create the experiment role using the AWS CLI.
To create an experiment role
-
Create a text file named
fis-role-trust-policy.json
and add the trust relationship policy described in Required trust relationship policy. -
Use the following create-role command to create a role and add the trust policy that you created in the previous step.
aws iam create-role --role-name
my-fis-role
--assume-role-policy-document file://fis-role-trust-policy.json
-
Create a text file named
fis-role-permissions-policy.json
and add a permissions policy. For more information, see Example policy statements. -
Use the following put-role-policy command to add the permissions policy that you created in the previous step.
aws iam put-role-policy --role-name
my-fis-role
--policy-namemy-fis-policy
--policy-document file://fis-role-permissions-policy.json
Required trust relationship policy
An experiment role must have a trust relationship that allows the AWS FIS service to assume the role.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "fis.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] }
We recommend that you use the aws:SourceAccount
and aws:SourceArn
condition keys to protect yourself against the
confused deputy problem. The source account is the owner of the experiment and the
source ARN is the ARN of the experiment. For example, you could add the following condition
block to your trust policy.
"Condition": { "StringEquals": { "aws:SourceAccount": "
account_id
" }, "ArnLike": { "aws:SourceArn": "arn:aws:fis:region
:account_id
:experiment/*" } }
Example policy statements
An experiment role must include a permissions policy that grants AWS FIS permission to run the experiment on your behalf. The specific policy statements that you must include depend on which AWS FIS actions you include in your experiment.
Example: Permissions for Amazon EC2 actions
The following policy grants AWS FIS permission to use the AWS FIS actions for Amazon EC2.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFISExperimentRoleEC2Actions", "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:StopInstances", "ec2:StartInstances", "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" }, { "Sid": "AllowFISExperimentRoleSpotInstanceActions", "Effect": "Allow", "Action": [ "ec2:SendSpotInstanceInterruptions" ], "Resource": "arn:aws:ec2:*:*:instance/*" } ] }
If your experiment uses the aws:ec2:stop-instances action to stop and then start an instance with an encrypted EBS volume, you must also grant AWS FIS permission to the KMS key used to encrypt the volume, or add the experiment role to the KMS key policy. The following example allows the AWS FIS to create grants on the specified KMS key.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": [ "arn:aws:kms:
region
:account_id
:key/key_id
" ], "Condition": { "Bool": { "kms:GrantIsForAWSResource": true } } } ] }
Example: Permissions for Amazon ECS actions
The following policy grants AWS FIS permission to use the AWS FIS actions for Amazon ECS.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFISExperimentRoleECSUpdateState", "Effect": "Allow", "Action": [ "ecs:UpdateContainerInstancesState" ], "Resource": "arn:aws:ecs:*:*:container-instance/*" }, { "Sid": "AllowFISExperimentRoleECSStopTask", "Effect": "Allow", "Action": [ "ecs:StopTask" ], "Resource": "arn:aws:ecs:*:*:task/*" } ] }
Example: Permissions for Amazon EKS actions
The following policy grants AWS FIS permission to use the AWS FIS actions for Amazon EKS.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFISExperimentRoleEKSReadOnly", "Effect": "Allow", "Action": [ "ec2:DescribeInstances" ], "Resource": "*" }, { "Sid": "AllowFISExperimentRoleEKSActions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*" } ] }
Example: Permissions for Amazon RDS actions
The following policy grants AWS FIS permission to use the AWS FIS actions for Amazon RDS.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFISExperimentRoleRDSReboot", "Effect": "Allow", "Action": [ "rds:RebootDBInstance" ], "Resource": "arn:aws:rds:*:*:db:*" }, { "Sid": "AllowFISExperimentRoleRDSFailOver", "Effect": "Allow", "Action": [ "rds:FailoverDBCluster" ], "Resource": "arn:aws:rds:*:*:cluster:*" } ] }
Example: Permissions for Systems Manager actions
The following policy grants AWS FIS permission to use the AWS FIS actions for Systems Manager.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFISExperimentRoleSSMReadOnly", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution", "ssm:ListCommands" ], "Resource": "*" }, { "Sid": "AllowFISExperimentRoleSSMSendCommand", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/*" ] }, { "Sid": "AllowFISExperimentRoleSSMCancelCommand", "Effect": "Allow", "Action": [ "ssm:CancelCommand" ], "Resource": "*" }, { "Sid": "AllowFISExperimentRoleSSMAutomation", "Effect": "Allow", "Action": [ "ssm:StartAutomationExecution", "ssm:StopAutomationExecution" ], "Resource": "*" }, { "Sid": "AllowFISExperimentRoleSSMAutomationPassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::
account_id
:role/role_name
" } ] }
Example: Permissions for fault injection actions
The following policy grants AWS FIS permission to use the AWS FIS actions for fault injection.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowFISExperimentRoleFaultInjectionActions", "Effect": "Allow", "Action": [ "fis:InjectApiInternalError", "fis:InjectApiThrottleError", "fis:InjectApiUnavailableError" ], "Resource": "arn:*:fis:*:*:experiment/*" } ] }