> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FIS Permissions

> This article explains the IAM roles required for AWS Fault Injection Simulator and how to create them.

AWS Fault Injection Simulator (FIS) relies on two distinct IAM roles to enforce security boundaries:

1. **User Role** – Grants permissions to *view*, *modify*, or *run* FIS experiments through the console or CLI.
2. **Service Role** – Assumed by FIS itself to perform actions on your AWS resources (for example, terminating an EC2 instance or failing over an Aurora database).

<Callout icon="triangle-alert" color="#FF6B6B">
  FIS experiments can induce downtime or resource failures. Apply the principle of least privilege when granting permissions to both roles.
</Callout>

## IAM Role Comparison

| IAM Role         | Purpose                                                                     | Example Permissions                                   |
| ---------------- | --------------------------------------------------------------------------- | ----------------------------------------------------- |
| FIS User Role    | Controls who can see, create, modify, or start experiments                  | `fis:CreateExperimentTemplate`, `fis:StartExperiment` |
| FIS Service Role | Defines what AWS resources FIS can interact with when running an experiment | `ec2:TerminateInstances`, `rds:FailoverDBCluster`     |

***

## 1. Create the FIS User Role

This role is assumed by your users or CI/CD pipelines. It requires a trust policy for IAM principals and permissions to manage FIS experiments.

```bash theme={null}
aws iam create-role \
  --role-name FISUserRole \
  --assume-role-policy-document file://trust-policy-user.json
```

Example `trust-policy-user.json`:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
    "Action": "sts:AssumeRole"
  }]
}
```

Attach the managed policy (or a custom policy) that grants FIS actions:

```bash theme={null}
aws iam attach-role-policy \
  --role-name FISUserRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonFISFullAccess
```

<Callout icon="lightbulb" color="#1CB2FE">
  You can scope the policy further by granting only the specific `fis:` actions your team requires.
</Callout>

***

## 2. Create the FIS Service Role

The service role grants FIS permission to manipulate AWS resources on your behalf. Start by defining a trust relationship allowing the FIS service to assume it.

```bash theme={null}
aws iam create-role \
  --role-name FISServiceRole \
  --assume-role-policy-document file://trust-policy-service.json
```

Example `trust-policy-service.json`:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "fis.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }]
}
```

Next, attach a policy that covers all resource actions your experiments require:

```bash theme={null}
aws iam put-role-policy \
  --role-name FISServiceRole \
  --policy-name FISServicePolicy \
  --policy-document file://fis-service-policy.json
```

An example snippet from `fis-service-policy.json`:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:TerminateInstances",
        "rds:FailoverDBCluster",
        "autoscaling:UpdateAutoScalingGroup"
      ],
      "Resource": "*"
    }
  ]
}
```

***

## References

* [AWS Fault Injection Simulator Documentation](https://docs.aws.amazon.com/fis/latest/userguide/)
* [AWS IAM CreateRole API](https://docs.aws.amazon.com/cli/latest/reference/iam/create-role.html)
* [AWS Managed Policies for FIS](https://docs.aws.amazon.com/iam/latest/UserGuide/access_policies_managed-vs-inline.html)

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/chaos-engineering/module/d49a2b6d-60a1-4603-965d-7e8292688875/lesson/b6ff5a51-f5e0-4ce5-89a4-6ceeee95600f" />
</CardGroup>