Chaos for IAM Boundaries: Prove Apps Fail Closed on Denied Actions

Inject: Deny s3:GetObject on private bucket
Expect: 403/typed AuthZError, no plaintext fallback, metric+trace
Fail:   empty body treated as "not found", retry storms, or public CDN fetch

Inject: Deny dynamodb:PutItem
Expect: transaction abort, no dual-write drift
Fail:   "success" after only the outbox write

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "ChaosDenyKmsDecrypt",
    "Effect": "Deny",
    "Action": ["kms:Decrypt"],
    "Resource": ["arn:aws:kms:us-east-1:123:key/chaos-target"],
    "Condition": {
      "StringEquals": { "aws:PrincipalTag/chaos": "iam-boundary" }
    }
  }]
}

# Staging-only: tag the task role principal, attach chaos policy, run suite, detach
aws iam put-role-policy --role-name checkout-task-staging \
  --policy-name ChaosDenyKms --policy-document file://chaos-deny-kms.json

pnpm chaos:iam --scenario kms-decrypt --expect fail-closed
aws iam delete-role-policy --role-name checkout-task-staging --policy-name ChaosDenyKms

import { KMSServiceException } from "@aws-sdk/client-kms";

export async function decryptField(blob: Buffer) {
  try {
    return await kms.decrypt({ CiphertextBlob: blob });
  } catch (e) {
    if (e instanceof KMSServiceException && e.name === "AccessDeniedException") {
      metrics.increment("authz.denied", { action: "kms:Decrypt" });
      throw new AuthZError("kms_decrypt_denied"); // typed, no fallback
    }
    throw e;
  }
}

// BAD
export async function decryptFieldBad(blob: Buffer) {
  try {
    return await kms.decrypt({ CiphertextBlob: blob });
  } catch {
    return blob; // fail OPEN — chaos must catch this
  }
}

# Synthetic expectations
scenarios:
  - name: deny-s3-get
    inject: Deny s3:GetObject
    expect_http: 403
    expect_metric: authz.denied{action=s3:GetObject}
    forbid_logs: ["fallback_public_url"]