A Chaos Experiment that Can Be Stopped
FIS refuses a template with no stop condition, which reads like a guarantee - and source = 'none' is a legal stop condition meaning the experiment never halts by itself. Refused here, along with targets that grow at run time and an empty-target mode that reports success for having tested nothing.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "fis" {
source = "www.iac-bazaar.com/iac-bazaar/aws-fis/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-fis
A Fault Injection Service experiment template that can be stopped, keeps a
record, and cannot quietly grow its own blast radius. Works with Terraform and
OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.
FIS refuses a template with no stop condition, and accepts "none" as one.
The API will not create an experiment template unless at least one
stop_condition is present, which reads like a safety guarantee. It is not:
source = "none" is a legal value, and it means the experiment will not halt by
itself for any reason - not a spiking error rate, not a failing health check,
not anything. A chaos experiment that nothing can stop is an outage you
scheduled. A precondition refuses it unless
accept_unstoppable_experiment says it was meant, and
can_be_stopped_automatically is an output so a policy test can assert on it.
selection_mode = "ALL" on a tag-matched target grows by itself. Targets
resolve when the experiment runs, not when the template is written - so a
resource that picks up the matching tag next month is in scope automatically and
nobody edited anything. COUNT(n) and PERCENT(n) bound it, and
unbounded_targets lists the ones that do not.
empty_target_resolution_mode = "skip" makes an experiment that matched
nothing report success. A green chaos experiment that tested nothing is worse
than a red one, because it gets filed as evidence. "fail" here.
Logging is off by default, so there is no record of which resources were affected, when each action started, or what the experiment actually did - for the one kind of run where you most want that record afterwards.
Smaller things: a precondition refuses an action whose target_name is not
a defined target, which otherwise fails at apply with an error naming neither
side; another refuses a non-none stop condition with no alarm ARN; and
multi-account targeting is surfaced because running across an organization is
a much larger blast radius than it looks in a diff.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-codebuild
privileged_mode hands the build the Docker socket, so anything it runs can read every environment variable and assume the service role. Off by default, and a PLAINTEXT variable whose name looks like a secret is refused.
aws-codeartifact
A repository with a public external connection serves whatever the public registry holds for any name it does not. This puts the connection on its own repository, reached through an upstream, and emits the origin-control commands Terraform cannot apply.
aws-appconfig
AppConfig exists to deploy a configuration slowly and roll it back automatically, and both halves are opt-in - the predefined AllAtOnce strategy is 100% of the fleet with zero bake time. Gradual here, and a precondition refuses an environment with no alarms, where automatic rollback has nothing to fire on.
aws-mwaa
webserver_access_mode defaults to PUBLIC_ONLY, and the Airflow UI is not a dashboard: anyone who reaches it can trigger a DAG, which is arbitrary Python running as the execution role. PRIVATE_ONLY here, all five log streams on, and a precondition refuses an unpinned requirements.txt or plugins.zip - where bucket write access is otherwise the same permission as code execution.
aws-codedeploy
CodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure.
aws-codepipeline
AWS-native CI/CD: CodePipeline orchestrating a CodeBuild project, with an encrypted private artifact bucket and least-privilege roles. Sources from S3 (or GitHub).