Amazon S3 has a durability record so strong that teams design around it without designing for it. Calls get written without timeouts, without fallbacks, and often without error handling beyond a log line, because the service is assumed to always answer.

Durability and availability are separate guarantees. Your objects can be perfectly safe and still temporarily unreachable, and an application that never considered that possibility handles it badly. Requests hang instead of failing. Threads tie up waiting. A page that needs one image waits on a call that will never timeout, leaving your customers to look at a blank page.

Gremlin finds these behaviors before your customers do. Run a blackhole experiment to validate that your services can tolerate an S3 outage. Run a latency experiment to ensure you can render the rest of your application while waiting for the object in the background. The fix is usually small—a timeout and a placeholder—but it can make a huge difference.