Fis Diagnostics

AWS Fault Injection Simulator Diagnostics

When to use

Any AWS FIS investigation — experiment template creation errors, target selection failures, action execution problems, stop condition configuration, IAM role issues, or experiment execution failures.

Investigation workflow

Step 1 — Collect and triage

aws fis list-experiment-templates --query 'experimentTemplates[*].{Id:id,Description:description}'
aws fis list-experiments --query 'experiments[*].{Id:id,State:state.status,Template:experimentTemplateId}'
aws fis list-target-account-configurations --experiment-template-id <template-id>

Step 2 — Domain deep dive

aws fis get-experiment-template --id <template-id>
aws fis get-experiment --id <experiment-id>
aws iam get-role --role-name <fis-role-name>
aws cloudwatch describe-alarms --alarm-names <stop-condition-alarm>

Step 3 — Detailed investigation

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=fis.amazonaws.com --max-results 20
aws fis list-actions --query 'actions[*].{Id:id,Description:description}'

Read references/guardrails.md before concluding on any FIS issue.

Tool quick reference

Gotchas: AWS Fault Injection Simulator

• FIS experiments cause REAL failures in your infrastructure. They are not simulations — they actually stop instances, inject latency, etc. Always use stop conditions.
• The FIS IAM role must have permissions to perform the actions AND to the target resources. A common mistake is granting FIS permissions but not resource-level permissions.
• Stop conditions use CloudWatch alarms. If the alarm transitions to ALARM state, FIS stops the experiment. The alarm must exist BEFORE the experiment starts.
• Target selection uses filters (tags, resource IDs, etc.) and selection mode (ALL, COUNT, PERCENT). If filters match no resources, the experiment fails.
• Some actions are irreversible (e.g., terminate instances). FIS does not restore resources after experiment completion.
• Experiment duration and action timing matter. Actions execute in parallel by default unless you define dependencies.
• Multi-account experiments require target account configurations and cross-account IAM roles.

Anti-hallucination rules

1. Always cite specific experiment IDs, template configs, or API responses as evidence.
2. FIS causes REAL failures. Never describe it as a simulation that doesn't affect production.
3. Stop conditions require pre-existing CloudWatch alarms. Never assume auto-creation.
4. Some actions are irreversible. Always warn about destructive actions.
5. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

14 runbooks