Create an IAM role for AWS FIS experiments

AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. To use AWS FIS, you must create an IAM role that grants AWS FIS the permissions required so that AWS FIS can run experiments on your behalf. You specify this experiment role when you create an experiment template. The IAM policy for the experiment role must grant permission to modify the resources that you specify as targets in your experiment template.

As a best practice, we recommend that you follow the standard security practice of granting least privilege. You can do so by specifying specific resource ARNs or tags in your policies.

Create an experiment role using the AWS CLI

Use the following procedure to create the experiment role using the AWS CLI.

To create an experiment role

1. Create a text file named fis-role-trust-policy.json and add the trust relationship policy described in Required trust relationship policy.

2. Use the following create-role command to create a role and add the trust policy that you created in the previous step.

   aws iam create-role --role-name my-fis-role --assume-role-policy-document file://fis-role-trust-policy.json

3. Create a text file named fis-role-permissions-policy.json and add a permissions policy. For more information, see Example policy statements.

4. Use the following put-role-policy command to add the permissions policy that you created in the previous step.

   aws iam put-role-policy --role-name my-fis-role --policy-name my-fis-policy --policy-document file://fis-role-permissions-policy.json

Required trust relationship policy

An experiment role must have a trust relationship that allows the AWS FIS service to assume the role.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                  "fis.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

We recommend that you use the aws:SourceAccount and aws:SourceArn condition keys to protect yourself against the confused deputy problem. The source account is the owner of the experiment and the source ARN is the ARN of the experiment. For example, you could add the following condition block to your trust policy.

"Condition": {
    "StringEquals": {
        "aws:SourceAccount": "account_id"
    },
    "ArnLike": {
        "aws:SourceArn": "arn:aws:fis:region:account_id:experiment/*"
    }
}

Example policy statements

An experiment role must include a permissions policy that grants AWS FIS permission to run the experiment on your behalf. The specific policy statements that you must include depend on which AWS FIS actions you include in your experiment.

Examples

• Amazon EC2

• Amazon ECS

• Amazon EKS

• Amazon RDS

• Systems Manager

• Fault injection

Example: Permissions for Amazon EC2 actions

The following policy grants AWS FIS permission to use the AWS FIS actions for Amazon EC2.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowFISExperimentRoleEC2Actions",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:StopInstances",
                "ec2:StartInstances",
                "ec2:TerminateInstances"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*"
        },
        {
            "Sid": "AllowFISExperimentRoleSpotInstanceActions",
            "Effect": "Allow",
            "Action": [
                "ec2:SendSpotInstanceInterruptions"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*"
        }
    ]
}

If your experiment uses the aws:ec2:stop-instances action to stop and then start an instance with an encrypted EBS volume, you must also grant AWS FIS permission to the KMS key used to encrypt the volume, or add the experiment role to the KMS key policy. The following example allows the AWS FIS to create grants on the specified KMS key.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "kms:CreateGrant",
            "Resource": [
                "arn:aws:kms:region:account_id:key/key_id"
            ],
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": true
                }
            }
        }
    ]
}

Example: Permissions for Amazon ECS actions

The following policy grants AWS FIS permission to use the AWS FIS actions for Amazon ECS.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowFISExperimentRoleECSUpdateState",
            "Effect": "Allow",
            "Action": [
                "ecs:UpdateContainerInstancesState"
            ],
            "Resource": "arn:aws:ecs:*:*:container-instance/*"
        },
        {
            "Sid": "AllowFISExperimentRoleECSStopTask",
            "Effect": "Allow",
            "Action": [
                "ecs:StopTask"
            ],
            "Resource": "arn:aws:ecs:*:*:task/*"
        }
    ]
}

Example: Permissions for Amazon EKS actions

The following policy grants AWS FIS permission to use the AWS FIS actions for Amazon EKS.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowFISExperimentRoleEKSReadOnly",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowFISExperimentRoleEKSActions",
            "Effect": "Allow",
            "Action": [
                "ec2:TerminateInstances"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*"
        }
    ]
}

Example: Permissions for Amazon RDS actions

The following policy grants AWS FIS permission to use the AWS FIS actions for Amazon RDS.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowFISExperimentRoleRDSReboot",
            "Effect": "Allow",
            "Action": [
                "rds:RebootDBInstance"
            ],
            "Resource": "arn:aws:rds:*:*:db:*"
        },
        {
            "Sid": "AllowFISExperimentRoleRDSFailOver",
            "Effect": "Allow",
            "Action": [
                "rds:FailoverDBCluster"
            ],
            "Resource": "arn:aws:rds:*:*:cluster:*"
        }
    ]
}

Example: Permissions for Systems Manager actions

The following policy grants AWS FIS permission to use the AWS FIS actions for Systems Manager.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowFISExperimentRoleSSMReadOnly",
            "Effect": "Allow",
            "Action": [
                "ssm:GetAutomationExecution",
                "ssm:ListCommands"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowFISExperimentRoleSSMSendCommand",
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ssm:*:*:document/*"
            ]
        },
        {
            "Sid": "AllowFISExperimentRoleSSMCancelCommand",
            "Effect": "Allow",
            "Action": [
                "ssm:CancelCommand"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowFISExperimentRoleSSMAutomation",
            "Effect": "Allow",
            "Action": [
                "ssm:StartAutomationExecution",
                "ssm:StopAutomationExecution"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowFISExperimentRoleSSMAutomationPassRole",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::account_id:role/role_name"
        }
    ]
}

Example: Permissions for fault injection actions

The following policy grants AWS FIS permission to use the AWS FIS actions for fault injection.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowFISExperimentRoleFaultInjectionActions",
            "Effect": "Allow",
            "Action": [
                "fis:InjectApiInternalError",
                "fis:InjectApiThrottleError",
                "fis:InjectApiUnavailableError"
            ],
            "Resource": "arn:*:fis:*:*:experiment/*"
        }
    ]
}