View a markdown version of this page

示例 AWS FIS 实验模板 - AWS 故障注入服务
根据筛选条件停止 EC2 实例停止运行指定数量的 EC2 实例运行预先配置的 AWS FIS SSM 文档运行预定义的自动化运行手册使用目标 IAM 角色限制对 EC2 实例执行的 API 操作对 Kubernetes 集群中的容器组（pod）CPU 进行压力测试指定数量的 Kinesis 数据流的预置吞吐量异常实验角色权限示例

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

示例 AWS FIS 实验模板

如果您使用 AWS FIS API 或命令行工具来创建实验模板，则可以在 JavaScript 对象表示法 (JSON) 中构造模板。有关实验模板组件的更多信息，请参阅 AWS FIS 实验模板组件。

要使用其中一个示例模板创建实验，请将其保存到 JSON 文件中（例如my-template.json），将中的italics占位符值替换为您自己的值，然后运行以下 create-experiment -template 命令。

aws fis create-experiment-template --cli-input-json file://my-template.json

根据筛选条件停止 EC2 实例

在指定 VPC 的指定区域中，以下示例会停止运行所有带有指定标签的 Amazon EC2 实例。两分钟后重启实例。

{
    "tags": {
        "Name": "StopEC2InstancesWithFilters"
    },
    "description": "Stop and restart all instances in us-east-1b with the tag env=prod in the specified VPC",
    "targets": {
        "myInstances": {
            "resourceType": "aws:ec2:instance",
            "resourceTags": {
                "env": "prod"
            },
            "filters": [
                {
                    "path": "Placement.AvailabilityZone",
                    "values": ["us-east-1b"]
                },
                {
                    "path": "State.Name",
                    "values": ["running"]
                },
                {
                    "path": "VpcId",
                    "values": [ "vpc-aabbcc11223344556"]
                }
            ],
            "selectionMode": "ALL"
        }
    },
    "actions": {
        "StopInstances": {
            "actionId": "aws:ec2:stop-instances",
            "description": "stop the instances",
            "parameters": {
                "startInstancesAfterDuration": "PT2M"
            },
            "targets": {
                "Instances": "myInstances"
            }
        }
    },
    "stopConditions": [
        {
            "source": "aws:cloudwatch:alarm",
            "value": "arn:aws:cloudwatch:us-east-1:111122223333:alarm:alarm-name"
        }
    ],
    "roleArn": "arn:aws:iam::111122223333:role/role-name"
}

停止运行指定数量的 EC2 实例

以下示例停止具有指定标签的三个实例。 AWS FIS 随机选择要停止的特定实例。两分钟后重启实例。

{
    "tags": {
        "Name": "StopEC2InstancesByCount"
    },
    "description": "Stop and restart three instances with the specified tag",
    "targets": {
        "myInstances": {
            "resourceType": "aws:ec2:instance",
            "resourceTags": {
                "env": "prod"
            },
            "selectionMode": "COUNT(3)"
        }
    },
    "actions": {
        "StopInstances": {
            "actionId": "aws:ec2:stop-instances",
            "description": "stop the instances",
            "parameters": {
                "startInstancesAfterDuration": "PT2M"
            },
            "targets": {
                "Instances": "myInstances"
            }
        }
    },
    "stopConditions": [
        {
            "source": "aws:cloudwatch:alarm",
            "value": "arn:aws:cloudwatch:us-east-1:111122223333:alarm:alarm-name"
        }
    ],
    "roleArn": "arn:aws:iam::111122223333:role/role-name"
}

运行预先配置的 AWS FIS SSM 文档

以下示例使用预配置的 AWS FIS SSM 文档在指定的 EC2 实例上运行 60 秒的 CPU 故障注入。 AWSFIS-Run-CPU-Stress AWS FIS 对实验进行了两分钟的监控。

{
    "tags": {
        "Name": "CPUStress"
    },
    "description": "Run a CPU fault injection on the specified instance",
    "targets": {
        "myInstance": {
            "resourceType": "aws:ec2:instance",
            "resourceArns": ["arn:aws:ec2:us-east-1:111122223333:instance/instance-id"],
            "selectionMode": "ALL"
        }
    },
    "actions": {
        "CPUStress": {
            "actionId": "aws:ssm:send-command",
            "description": "run cpu stress using ssm",
            "parameters": {
                "duration": "PT2M",
                "documentArn": "arn:aws:ssm:us-east-1::document/AWSFIS-Run-CPU-Stress",
                "documentParameters": "{\"DurationSeconds\": \"60\", \"InstallDependencies\": \"True\", \"CPU\": \"0\"}"
            },
            "targets": {
                "Instances": "myInstance"
            }
        }
    },
    "stopConditions": [
        {
            "source": "aws:cloudwatch:alarm",
            "value": "arn:aws:cloudwatch:us-east-1:111122223333:alarm:alarm-name"
        }
    ],
    "roleArn": "arn:aws:iam::111122223333:role/role-name"
}

运行预定义的自动化运行手册

以下示例使用系统管理器提供的运行手册向 Amazon SNS 发布通知。 AWS-PublishSNSNotification 角色必须具有向指定 SNS 主题发布通知的权限。

{
    "description": "Publish event through SNS",
    "stopConditions": [
        {
            "source": "none"
        }
    ],
    "targets": {
    },
    "actions": {
        "sendToSns": {
            "actionId": "aws:ssm:start-automation-execution",
            "description": "Publish message to SNS",
            "parameters": {
                "documentArn": "arn:aws:ssm:us-east-1::document/AWS-PublishSNSNotification",
                "documentParameters": "{\"Message\": \"Hello, world\", \"TopicArn\": \"arn:aws:sns:us-east-1:111122223333:topic-name\"}",
                "maxDuration": "PT1M"
            },
            "targets": {
            }
        }
    },
    "roleArn": "arn:aws:iam::111122223333:role/role-name"
}

使用目标 IAM 角色限制对 EC2 实例执行的 API 操作

以下示例限制 100% API 调用，该调用是在目标定义中指定的 IAM 角色发出的 API 调用的操作定义中指定的。

注意

如果您希望将作为自动扩缩组成员的 EC2 实例作为目标，请改为使用 aws:ec2:asg-insufficient-instance-capacity-error 操作，并以自动扩缩组为目标。有关更多信息，请参阅 aws: ec2: asg-实例容量不足错误。

{
    "tags": {
        "Name": "ThrottleEC2APIActions"
    },
    "description": "Throttle the specified EC2 API actions on the specified IAM role",
    "targets": {
        "myRole": {
            "resourceType": "aws:iam:role",
            "resourceArns": ["arn:aws:iam::111122223333:role/role-name"],
            "selectionMode": "ALL"
        }
    },
    "actions": {
        "ThrottleAPI": {
            "actionId": "aws:fis:inject-api-throttle-error",
            "description": "Throttle APIs for 5 minutes",
            "parameters": {
                "service": "ec2",
                "operations": "DescribeInstances,DescribeVolumes",
                "percentage": "100",
                "duration": "PT2M"
            },
            "targets": {
                "Roles": "myRole"
            }
        }
    },
    "stopConditions": [
        {
            "source": "aws:cloudwatch:alarm",
            "value": "arn:aws:cloudwatch:us-east-1:111122223333:alarm:alarm-name"
        }
    ],
    "roleArn": "arn:aws:iam::111122223333:role/role-name"
}

对 Kubernetes 集群中的容器组（pod）CPU 进行压力测试

以下示例使用 Chaos Mesh 对 Amazon EKS Kubernetes 集群中的容器组（pod）CPU 进行一分钟压力测试。

{
    "description": "ChaosMesh StressChaos example",
    "targets": {
        "Cluster-Target-1": {
            "resourceType": "aws:eks:cluster",
            "resourceArns": [
                "arn:aws:eks:arn:aws::111122223333:cluster/cluster-id"
            ],
            "selectionMode": "ALL"
        }
    },
    "actions": {
        "TestCPUStress": {
            "actionId": "aws:eks:inject-kubernetes-custom-resource",
            "parameters": {
                "maxDuration": "PT2M",
                "kubernetesApiVersion": "chaos-mesh.org/v1alpha1",
                "kubernetesKind": "StressChaos",
                "kubernetesNamespace": "default",
                "kubernetesSpec": "{\"selector\":{\"namespaces\":[\"default\"],\"labelSelectors\":{\"run\":\"nginx\"}},\"mode\":\"all\",\"stressors\": {\"cpu\":{\"workers\":1,\"load\":50}},\"duration\":\"1m\"}"
            },
            "targets": {
                "Cluster": "Cluster-Target-1"
            }
        }
    },
    "stopConditions": [{
        "source": "none"
    }],
    "roleArn": "arn:aws:iam::111122223333:role/role-name",
    "tags": {}
}

以下示例使用 Litmus 对 Amazon EKS Kubernetes 集群中的容器组（pod）CPU 进行一分钟压力测试。

{
    "description": "Litmus CPU Hog",
    "targets": {
        "MyCluster": {
            "resourceType": "aws:eks:cluster",
            "resourceArns": [
                "arn:aws:eks:arn:aws::111122223333:cluster/cluster-id"
            ],
            "selectionMode": "ALL"
        }
    },
    "actions": {
        "MyAction": {
            "actionId": "aws:eks:inject-kubernetes-custom-resource",
            "parameters": {
                "maxDuration": "PT2M",
                "kubernetesApiVersion": "litmuschaos.io/v1alpha1",
                "kubernetesKind": "ChaosEngine",
                "kubernetesNamespace": "litmus",
                "kubernetesSpec": "{\"engineState\":\"active\",\"appinfo\":{\"appns\":\"default\",\"applabel\":\"run=nginx\",\"appkind\":\"deployment\"},\"chaosServiceAccount\":\"litmus-admin\",\"experiments\":[{\"name\":\"pod-cpu-hog\",\"spec\":{\"components\":{\"env\":[{\"name\":\"TOTAL_CHAOS_DURATION\",\"value\":\"60\"},{\"name\":\"CPU_CORES\",\"value\":\"1\"},{\"name\":\"PODS_AFFECTED_PERC\",\"value\":\"100\"},{\"name\":\"CONTAINER_RUNTIME\",\"value\":\"docker\"},{\"name\":\"SOCKET_PATH\",\"value\":\"/var/run/docker.sock\"}]},\"probe\":[]}}],\"annotationCheck\":\"false\"}"
            },
            "targets": {
                "Cluster": "MyCluster"
            }
        }
    },
    "stopConditions": [{
        "source": "none"
    }],
    "roleArn": "arn:aws:iam::111122223333:role/role-name",
    "tags": {}
}

指定数量的 Kinesis 数据流的预置吞吐量异常

以下示例对最多五个带有指定标签的 Kinesis 数据流的请求的 100% 抛出预置吞吐量异常。 AWS FIS 随机选择要影响的视频流。5 分钟后故障解决。

{
    "description": "Kinesis stream experiment",
    "targets": {
        "KinesisStreams-Target-1": {
            "resourceType": "aws:kinesis:stream",
            "resourceTags": {
                   "tag-key": "tag-value"
            },
            "selectionMode": "COUNT(5)"
        }
    },
    "actions": {
         "kinesis": {
              "actionId": "aws:kinesis:stream-provisioned-throughput-exception",
              "description": "my-stream",
              "parameters": {
                   "duration": "PT5M",
                   "percentage": "100",
                   "service": "kinesis"
              },
              "targets": {
                    "KinesisStreams": "KinesisStreams-Target-1"
              }
         }
   },
   "stopConditions": [
         {
              "source": "none"
         }
   ],
   "roleArn": "arn:aws:iam::111122223333:role/role-name",
   "tags": {},
   "experimentOptions": {
       "accountTargeting": "single-account",
       "emptyTargetResolutionMode": "fail"
   }    
}

实验角色权限示例

以下权限允许您在影响 50% 请求的特定直播上运行aws:kinesis:stream-provisioned-throughput-exception和aws:kinesis:stream-expired-iterator-exception操作。

{
    "Version": "2012-10-17",
     "Statement": [
        {
            "Effect": "Allow",
            "Action": "kinesis:InjectApiError",
            "Resource": "*",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "kinesis:FisActionId": [
                        "aws:kinesis:stream-provisioned-throughput-exception",
                        "aws:kinesis:stream-expired-iterator-exception" 
                    ],
                    "kinesis:FisTargetArns": [
                        "arn:aws:kinesis:us-east-1:111122223333:stream/stream-name"
                    ]
                },
                "NumericEquals": {
                    "kinesis:FisInjectPercentage": "50"
                }
            }
        },
        {
             "Action": [
                   "kinesis:DescribeStreamSummary"
              ],
             "Resource": "*",
             "Effect": "Allow"
        }
    ]
}