AWS fis documentation change

Service: fis · 2025-10-16 · Documentation medium

File: fis/latest/userguide/experiment-template-example.md

Summary

Added documentation for Kinesis Data Streams throughput exception experiment template and experiment role permissions example

Security assessment

The change adds documentation for security-related IAM permissions configuration (experiment role permissions example) but does not indicate a security vulnerability fix. The Kinesis throughput exception example documents fault injection testing capabilities rather than addressing a security flaw.

Diff

diff --git a/fis/latest/userguide/experiment-template-example.md b/fis/latest/userguide/experiment-template-example.md
index f1bc477c2..533f69e0c 100644
--- a//fis/latest/userguide/experiment-template-example.md
+++ b//fis/latest/userguide/experiment-template-example.md
@@ -5 +5 @@
-Stop EC2 instances based on filtersStop a specified number of EC2 instancesRun a pre-configured AWS FIS SSM documentRun a predefined Automation runbookThrottle API actions on EC2 instances with the target IAM roleStress test CPU of pods in a Kubernetes cluster
+Stop EC2 instances based on filtersStop a specified number of EC2 instancesRun a pre-configured AWS FIS SSM documentRun a predefined Automation runbookThrottle API actions on EC2 instances with the target IAM roleStress test CPU of pods in a Kubernetes clusterProvisioned throughput exception for specified number of Kinesis Data StreamsExperiment role permissions example
@@ -29,0 +30,4 @@ To create an experiment using one of the example templates, save it to a JSON fi
+  * Provisioned throughput exception for specified number of Kinesis Data Streams
+
+  * Experiment role permissions example
+
@@ -315,0 +320,80 @@ The following example uses Litmus to stress test the CPU of pods in an Amazon EK
+## Provisioned throughput exception for specified number of Kinesis Data Streams
+
+The following example throws a provisioned throughput exception for 100% of requests up to five Kinesis Data Streams with the specified tag. AWS FIS selects the streams to affect at random. After 5 minutes the fault is removed.
+    
+    
+    {
+        "description": "Kinesis stream experiment",
+        "targets": {
+            "KinesisStreams-Target-1": {
+                "resourceType": "aws:kinesis:stream",
+                "resourceTags": {
+                       "tag-key": "tag-value"
+                },
+                "selectionMode": "COUNT(5)"
+            }
+        },
+        "actions": {
+             "kinesis": {
+                  "actionId": "aws:kinesis:stream-provisioned-throughput-exception",
+                  "description": "my-stream",
+                  "parameters": {
+                       "duration": "PT5M",
+                       "percentage": "100",
+                       "service": "kinesis"
+                  },
+                  "targets": {
+                        "KinesisStreams": "KinesisStreams-Target-1"
+                  }
+             }
+       },
+       "stopConditions": [
+             {
+                  "source": "none"
+             }
+       ],
+       "roleArn": "arn:aws:iam::111122223333:role/role-name",
+       "tags": {},
+       "experimentOptions": {
+           "accountTargeting": "single-account",
+           "emptyTargetResolutionMode": "fail"
+       }    
+    }
+
+## Experiment role permissions example
+
+The following permission allows you to run the `aws:kinesis:stream-provisioned-throughput-exception` and `aws:kinesis:stream-expired-iterator-exception` actions on a specific stream impacting 50% of requests.
+    
+    
+    {
+        "Version": "2012-10-17",		 	 	 
+         "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": "kinesis:InjectApiError",
+                "Resource": "*"
+                "Condition": {
+                    "ForAllValues:StringEquals": {
+                        "kinesis:FisActionId": [
+                            "aws:kinesis:stream-provisioned-throughput-exception",
+                            "aws:kinesis:stream-expired-iterator-exception" 
+                        ],
+                        "kinesis:FisTargetArns": [
+                            "arn:aws:kinesis:us-east-1:111122223333:stream/stream-name"
+                        ],
+                    },
+                    "NumericEquals": {
+                        "kinesis:FisInjectPercentage": "50"
+                    }
+                }
+            },
+            {
+                 "Action": [
+                       "kinesis:DescribeStreamSummary",
+                  ],
+                 "Resource": "*",
+                 "Effect": "Allow"
+            }
+        ]
+    }
+