Single-account execution role

For a single-account test, create one execution role with a trust policy that allows AWS FIS to assume it and a permissions policy for the test template that you use.

Trust policy

The execution role must trust the AWS FIS service. The trust policy is the same for every test template. The aws:SourceAccount and aws:SourceArn conditions protect against the confused deputy problem, so that only experiments owned by your account can assume the role.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "FISTrustPolicy",
      "Effect": "Allow",
      "Principal": {
        "Service": "fis.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "account-id"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:fis:*:account-id:experiment/*"
        }
      }
    }
  ]
}
  

Permissions policy

Attach the permissions policy for the test template that your test uses.