SlideShare a Scribd company logo
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Dickson Yue, AWS Solutions Architect
9/15/2017
Building Powerful IoT apps with
AWS IoT and Websockets
AWS Startup Day – Hong Kong
Outline
• MQTT recap
• WebSockets: what and why?
• Authentication and Authorization
• Demo + Code
AWS IoT
Publish / Subscribe
Standard Protocol Support
MQTT, HTTP, WebSockets
Long Lived Connections
Receive signals from the cloud
Secure by Default
Connect securely via X509 Certs
and TLS 1.2 Client Mutual Auth

Recommended for you

The Future is Now: The ForgeRock Identity Platform, Early 2017 Release
The Future is Now: The ForgeRock Identity Platform, Early 2017 ReleaseThe Future is Now: The ForgeRock Identity Platform, Early 2017 Release
The Future is Now: The ForgeRock Identity Platform, Early 2017 Release

The ForgeRock Identity Platform is trusted by companies around the world to be their foundation for digital transformation. ForgeRock extends their leadership in this space with the latest release of the ForgeRock Identity Platform, featuring advanced capabilities to meet the needs of today’s consumer facing digital services. In this webinar, learn how new features improve customer engagement and insight, offer greater privacy controls, extend security and usability for internet of things (IoT), enable DevOps and dynamic architectures, and more.

Introduction to Azure AD and Azure AD B2C
Introduction to Azure AD and Azure AD B2CIntroduction to Azure AD and Azure AD B2C
Introduction to Azure AD and Azure AD B2C

Azure AD & Azure AD B2C provide identity and access management services. Azure AD is primarily for enterprise use, allowing single sign-on for Office 365, Azure, and other cloud services. It offers features like multi-factor authentication, application access control, and on-premises Active Directory synchronization. Azure AD B2C is designed more for consumer-facing apps and allows fully customizable login experiences and identity providers like social accounts and local usernames. Both services provide user management and authentication capabilities for applications.

azureazure active directoryazure active directory b2c
Cognito Customer Deep Dive
Cognito Customer Deep DiveCognito Customer Deep Dive
Cognito Customer Deep Dive

by Quint Van Deman, Sr. Business Development Manager, AWS Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily. Amazon Cognito scales to millions of users and supports sign-in.

awsamazon web servicescloud
MQTT PubSub Topic Subscriptions
PUBLISH
weather-station/echo-base/temperature
SUBSCRIBE
weather-station/echo-base/temperature
weather-station/echo-base/#
weather-station/+/temperature
Comparing protocols
MQTT
• Lightweight
• Bidirectional
HTTP
• Broad support (browsers)
• Request-reply
Client Server Client Server
AWS IoT protocol comparison
Capability MQTT HTTP
Publish Yes Yes
Subscribe Yes No
WebSockets to the rescue
GET wss://…/mqtt?X-Amz-Signature=…
Connection: Upgrade
Sec-WebSocket-Protocol: mqtt
…
Upgrade?
OK
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
HTTP

Recommended for you

OAuth & OpenID Connect Deep Dive
OAuth & OpenID Connect Deep DiveOAuth & OpenID Connect Deep Dive
OAuth & OpenID Connect Deep Dive

OAuth and OpenID Connect are the two most important security specs that API providers need to be aware of. In this session, Travis Spencer, CEO of Curity, will cram in as much about these two protocols as will fit into 20 minutes.

nordic apisaustin api summitapi
OAuth2 - Introduction
OAuth2 - IntroductionOAuth2 - Introduction
OAuth2 - Introduction

The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

oauthknoldusknowledge sharing
Content Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso
Content Delivery Using Amazon CloudFront - AWS Presentation - John MancusoContent Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso
Content Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso

CloudFront is Amazon's content delivery network (CDN) that caches copies of content across a global network of edge servers to improve performance and reduce latency. It uses a distribution configuration to determine how to route requests for content to the optimal edge location. Origins specify the source of the content. CloudFront delivers content through its edge locations, improving load times, providing high bandwidth, and ensuring availability. Many companies use CloudFront to deliver media, software downloads, web assets and even dynamic content through features like cache behaviors and multiple origins. Getting started is self-service through the AWS Management Console or APIs.

cloudfrontawsstoragenyc2012enterprise
WebSockets to the rescue
HTTP
MQTT
SUBSCRIBE
PUBLISH
…
AWS IoT protocol comparison
*Using WebSockets to upgrade HTTP connections to MQTT connections
Capability MQTT HTTP
Publish Yes Yes
Subscribe Yes Yes*
Outline
• MQTT recap
• WebSockets: what and why?
• Authentication and Authorization
• Demo + Code
Securing AWS Resource Access

Recommended for you

Security Best Practices on AWS
Security Best Practices on AWSSecurity Best Practices on AWS
Security Best Practices on AWS

This document discusses security best practices when using AWS. It covers the shared responsibility model between AWS and customers, leveraging AWS security features, understanding customer needs to form a security stance, and engaging security assessors early. It provides an overview of identity and access management tools like IAM, security groups, VPCs and direct connects. The document emphasizes applying a "security by design" approach when building on AWS.

webinarsecurityaws
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...

발표영상 다시보기: https://youtu.be/il8wpd7gxe8 CI/CD 기술을 통해 팀은 민첩성을 높이고 고품질 제품을 신속하게 출시 할 수 있습니다. 이 강의에서는 컨테이너화 된 응용 프로그램을 관리 할 수 있도록 CI/CD 워크 플로우 작성을위한 모범 사례를 안내합니다. AWS Cloud Development Kit를 사용하여 코드 애플리케이션 모델로 인프라를 다루고 AWS CodePipeline 및 AWS CodeBuild를 사용하여 CI/CD 릴리스 파이프 라인을 설정하는 방법을 보여줍니다. 마지막으로 AWS CodeDeploy를 사용한 안전한 배포 자동화에 대해 설명합니다.

2020_03_builders_webinar
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...

In this session, we will walk through the fundamentals of Amazon Virtual Private Cloud (VPC). We will discuss core VPC concepts including picking your IP space, subnetting, routing, security, NAT and VPC Endpoints.

vpcamazon vpccloud-computing
Authentication vs authorization
Authentication:
Prove your identity
Authorization:
Restrict access
Authentication for devices
Device credentials
• Private key (authenticate the device)
• Certificate (register the device with IoT)
• Root CA cert (authenticate IoT)
Authentication for devices
Administrator
CreateCertificate
Generate CSR
Generate
Private Key
Certificate
Connect through MQTT libary
import paho.mqtt.client as mqtt
def init():
global client
try:
client = mqtt.Client()
client.on_connect = on_connect
client.on_message = on_message
client.clientid = clientid
client.tls_set( "../../certs/root.pem",
certfile="../../certs/grove-cert.pem",
keyfile="../../certs/grove-privateKey.pem",
tls_version=ssl.PROTOCOL_TLSv1_2, ciphers=None )
client.connect("data.iot.us-east-1.amazonaws.com", 8883, 10)
client.loop_forever()
except:
print "Mqtt Unexpected error:", sys.exc_info()[0]

Recommended for you

Creating Event Driven Applications with Azure Event Grid
Creating Event Driven Applications with Azure Event GridCreating Event Driven Applications with Azure Event Grid
Creating Event Driven Applications with Azure Event Grid

Azure Event Grid is an event service built for modern applications. Learn about what is Azure Event Grid and how you can use it for an event driven architecture in the cloud.

azureazure event gridserverless
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...

AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 문종민 솔루션즈 아키텍트, AWS 본 세션은 AWS를 처음 접하는 분들을 대상으로 AWS의 150여개 이상의 서비스들 중 가장 중심이 되는 컴퓨팅, 스토리지, 네트워크 등의 핵심 서비스를 기술적 관점에서 소개합니다. 클라우드에서 신규 서비스 구축 및 기존 데이터센터 워크로드를 이전할 때, Amazon EC2, S3 및 RDS, VPC 등의 서비스를 통해 어떻게 빠르게 AWS 상에서 시스템 구축할 수 있는지 살펴봅니다.

aws_summit_seoul_2019day2day2_track1
Deploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerDeploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control Tower

AWS Control Tower is a new AWS service for cloud administrators to set up and govern their secure, compliant, multi-account environments on AWS. In this session, University of York will discuss their implementation of AWS Landing Zone. We’ll also explain how AWS Control Tower automates AWS Landing Zone creation with best-practice blueprints.

create option "awscontroltowerwebinar"
HTTP
curl --tlsv1.2
--cacert root.pem --cert pi01-cert.pem --key pi01-privateKey.pem
-X POST -d "{ "serialNumber": "G030JF053216F1BS", "clickType":
"SINGLE", "batteryVoltage": "2000mV" }"
"https://a1omffl4uase1e.iot.us-east-
1.amazonaws.com:8443/topics/iotbutton/virtualButton?qos=1"
AWS IoT protocol comparison
Capability MQTT HTTP
Publish Yes Yes
Subscribe Yes No
Certificate Auth Yes Yes
Sig V4 Auth No Yes
AWS IoT protocol comparison
Capability MQTT HTTP
Publish Yes Yes
Subscribe Yes No
Certificate Auth Yes Yes
Sig V4 Auth No Yes
AWS IoT protocol comparison
Capability MQTT HTTP
Publish Yes Yes
Subscribe Yes Yes*
Certificate Auth Yes Yes
Sig V4 Auth Yes* Yes
*Using WebSockets to upgrade HTTP connections to MQTT connections

Recommended for you

Amazon CloudFront 101
Amazon CloudFront 101Amazon CloudFront 101
Amazon CloudFront 101

The document discusses content delivery networks (CDNs) and Amazon CloudFront. A CDN improves performance and reliability by caching content across globally distributed edge servers close to users. CloudFront is AWS's CDN that provides low latency, high bandwidth, redundancy, scalability and cost-effectiveness. It supports dynamic and static content delivery via HTTP, RTMP and more. Customers can use CloudFront to improve website performance and user experience.

cdncloudfrontcontent delivery network
100.RED HAT SINGLE SIGN-ON
100.RED HAT SINGLE SIGN-ON100.RED HAT SINGLE SIGN-ON
100.RED HAT SINGLE SIGN-ON

redhat sso, keycloak

red hat ssosso구글 로그인
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터

AWS에서 애플리케이션을 빌드하고 배포하려고 할 때 개발자와 애플리케이션에 올바른 권한을 부여하는 것은 보안에 매우 중요합니다. 이 과정에서는 AWS IAM의 주요 엔티티들에 대해서 알아보�� STS를 통한 임시 자격 증명, 자격 증명 연동 및 모범 사례 그리고 문제 해결에 대해서 개발자와 운영자 보안 담당자의 관점을 통해 입체적으로 알아봅니다.

Authenticated
• End-users sign in
• Customize user-specific policy
in AWS IoT
• Users cannot access AWS IoT
until IoT policy is attached
Cognito Identities in AWS IoT
Unauthenticated
• No sign-in (anonymous)
• Use IAM role policy and policy
variables to restrict access
• No user-specific policy
in AWS IoT
Unauthenticated end-users
Unauthenticated access for end-users
Amazon
Cognito
Get Credentials
AssumeRole
Connect through JavaScript
var region = c.AWS.region; //'ap-northeast-1'
var iotEndpoint = c.AWS.iotEndpoint;
var identityPoolId = c.AWS.identityPoolId;
AWS.config.region = region;
AWS.config.credentials =
new AWS.CognitoIdentityCredentials({ IdentityPoolId: identityPoolId });
AWS.config.credentials.get(function(){
var signedUrl = getSignedUrl();
initClient(signedUrl);
});
var requestUrl = 'wss://' + host + canonicalUri + '?' + canonicalQuerystring;
//Unauthenticated

Recommended for you

Azure Security Overview
Azure Security OverviewAzure Security Overview
Azure Security Overview

This presentation walks through the Security and Compliance functionality to customers leveraging Azure as a compute environment. It includes deep-dive references to detailed information on each topic presented.

infoseccybersecurityazure
AWS Security
AWS SecurityAWS Security
AWS Security

This document summarizes Amazon Web Services' (AWS) security processes and certifications. It discusses AWS' SAS70 Type II certification, physical security measures, data backup processes, multi-factor authentication, virtual machine isolation, network security controls, and use of encryption and virtual private clouds. The document is intended to provide an overview of AWS' security practices and resources for customers.

securitysolution-architecture-and-best-practicesevents. awssummitseattle2010
Building an AI-based service with Rekognition, Polly and Lex
Building an AI-based service with Rekognition, Polly and LexBuilding an AI-based service with Rekognition, Polly and Lex
Building an AI-based service with Rekognition, Polly and Lex

Presentation given during Start Up Day Hong Kong on September 15, 2017 within the Architecture track

hk_startup_daystartupai
Unauthenticated access for end-users
Amazon
Cognito
Get Credentials
AssumeRole
AWS STS
AWS IAM
permissions
role
temporary
security
credentials
Unauthenticated access for end-users
Amazon
Cognito
AWS STS
AWS IAM
permissions
role
WebSocket Connect
temporary
security
credentials
Allowed?
Yes!
User-specific policies
{
"Effect": "Allow",
"Action": ["iot:Publish", "iot:Subscribe"]
"Resource": [
"arn:*:topic/home/123_aws_ave",
"arn:*:topicfilter/home/123_aws_ave"
]
}
{
"Effect": "Allow",
"Action": ["iot:Publish", "iot:Subscribe"]
"Resource": [
"arn:*:topic/home/456_iot_ln",
"arn:*:topicfilter/home/456_iot_ln"
]
}
Policy for Alice, Bob: Policy for Chuck:
Fine-grained access control
SUB home/456_iot_ln
SUB home/123_aws_ave/#
PUB home/123_aws_ave/light_1/on
SUB home/123_aws_ave/#
PUB home/123_aws_ave/door_1/open
Alice
Bob
Chuck

Recommended for you

Real-time Chat Backend on AWS IoT 20160422
Real-time Chat Backend on AWS IoT 20160422Real-time Chat Backend on AWS IoT 20160422
Real-time Chat Backend on AWS IoT 20160422

This document describes building a real-time chat backend using AWS IoT. AWS IoT provides a managed WebSocket that allows building simple, scalable, and extensible client applications. The document demonstrates connecting mobile clients to AWS IoT topics using the IoT SDK, subscribing and publishing messages, and using IoT rules to trigger actions like mobile push notifications based on topic data.

aws iotawsamazon web services
Real-Time Event Processing
Real-Time Event ProcessingReal-Time Event Processing
Real-Time Event Processing

NASA LandSat data can be stored, transformed, navigated, and visualized. In this session we will explore how the LandSat dataset is stored in Amazon Simple Storage Service (S3), one of the recommended cloud storage services in AWS for storage of petabytes of data, and how data stored in S3 can be processed on the server with the Lambda service, visualized for users, and made available to search engines. Create by: Ben Snively, Senior Solutions Architect

satelliteaws cloudbig data
A guide on Aws Security Token Service
A guide on Aws Security Token ServiceA guide on Aws Security Token Service
A guide on Aws Security Token Service

The document discusses AWS Security Token Service (STS), which enables users to request temporary security credentials. STS works with AWS Identity and Access Management (IAM) to provide credentials for IAM users or federated users authenticated outside of AWS. STS allows generating limited-privilege credentials for IAM users, federated users authenticated by an identity provider, and for delegating access to services that need to access AWS resources. The temporary credentials provided by STS can be used to make AWS API calls for the duration specified, providing a secure way to access AWS resources without long-term credentials.

cloud securitysecurity token servicecloud safety
Fine-grained access control
PUB home/123_aws_ave/door_1/open
SUB home/123_aws_ave/#
PUB home/123_aws_ave/light_1/on
SUB home/123_aws_ave/#
PUB home/123_aws_ave/door_1/open
Alice
Bob
Chuck
Policy variables for Cognito users
AWS IAM
PUBLISH foo/us-east-1:abcdef-my-cognito-id
temporary
security
credentials
{
"Effect": "Allow",
"Action": "iot:Publish",
"Resource": [
"arn:*:topic/foo/${cognito-identity.amazonaws.com:sub}"
]
}
Policy variables for Cognito users
{
"Effect": "Allow",
"Action": "iot:Publish",
"Resource": [
"arn:*:topic/foo/${cognito-identity.amazonaws.com:sub}"
]
}
AWS.config.region = 'us-east-1';
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId: 'us-east-1:YOUR_IDENTITY_POOL_ID'
});
AWS.config.credentials.get(function(err)) {
if (err) { return; }
var cognitoId = AWS.config.credentials.identityId;
mqttClient.connect(...);
mqttClient.publish('foo/' + cognitoId);
});
permissions
role
Outline
• MQTT recap
• WebSockets: what and why?
• Authentication and Authorization
• Demo + Code

Recommended for you

CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング
CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキングCloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング
CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング

お手軽に利用でき、大小あらゆる配信規模に対応してくれるCDNサービスCloudFrontの一歩踏み込んだ使いドコロを紹介します。 昨今激増しているモバイルデバイス向け動画配信におけるセキュアな動画配信と、Redshiftを組み合わせたお安く実現するリアルタイム性の高いレポーティングインフラについてご紹介します。

cloudfrontanalyzestreaming
AWS Black Belt Tech シリーズ 2015 - AWS IoT
AWS Black Belt Tech シリーズ 2015 - AWS IoTAWS Black Belt Tech シリーズ 2015 - AWS IoT
AWS Black Belt Tech シリーズ 2015 - AWS IoT

2015年12月2日に放送したAWS IoTの回の資料です。今後の予定は以下をご覧ください。 http://aws.amazon.com/jp/about-aws/events/#webinar

iotaws
Developing Connected Applications with AWS IoT - Technical 301
Developing Connected Applications with AWS IoT - Technical 301Developing Connected Applications with AWS IoT - Technical 301
Developing Connected Applications with AWS IoT - Technical 301

AWS IoT is a managed cloud platform that can support billions of devices and trillions of messages, and can process and route those messages to AWS endpoints and to other devices reliably and securely. In this session we look at patterns and architectures for developing connected applications using AWS IoT. We dive into demo applications that tie together physical IoT devices, web browsers, identity providers, and mobile devices to create smart, connected applications using Amazon Web Services. Speaker: Adam Larter, Solutions Architect, Amazon Web Services Featured Customer - Tekt Industries

awssydsummit
http://bit.ly/awsiotws
Authentication for end-users
Configuring Cognito with AWS IoT
UnauthenticatedAuthenticated
Authenticated access for end-users
Amazon
Cognito
Get Credentials
temporary
security
credentials
AWS STSAWS IAM
permissions
role
temporary
security
credentials

Recommended for you

Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"
Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"
Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"

"AWS Greengrass & IoT demo" - by Jeremy Cowan, Solutions Architect at Amazon Web Services This presentation was given at the AWS Chicago user group event on 22 March 2017 on the Internet of Things (IoT) https://www.meetup.com/AWS-Chicago/events/237737145/ @jicowan

aws chicagoawsamazon
Best Practices for IoT Security in the Cloud
Best Practices for IoT Security in the Cloud Best Practices for IoT Security in the Cloud
Best Practices for IoT Security in the Cloud

This session will introduce best practices for IoT security in the cloud and the access control mechanisms used by AWS IoT. These mechanisms can be used to not only securely build and provision devices, but also to integrate devices with other AWS services. As a result, you are able to scale and innovate, while maintaining a secure environment.

amazon-web-servicescloud-computingstartups
Best Practices with IoT Security - February Online Tech Talks
Best Practices with IoT Security - February Online Tech TalksBest Practices with IoT Security - February Online Tech Talks
Best Practices with IoT Security - February Online Tech Talks

AWS IoT is a managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices. This tech talk will introduce the best practices for IoT Security in the cloud and the access control mechanisms used by AWS IoT. These mechanisms can be used to not only securely build and provision devices, but also to integrate devices with other AWS services to create secure solutions. Learning Objectives: • Learn common Internet of Things security issues • Learn about AWS IoT security and access control mechanisms • Learn how to build secure interactions with the AWS Cloud

amazon web serviceswebinaraws
Connect through JavaScript
var region = c.AWS.region; //'ap-northeast-1'
var iotEndpoint = c.AWS.iotEndpoint;
var identityPoolId = c.AWS.identityPoolId;
AWS.config.region = region;
AWS.config.credentials =
new AWS.CognitoIdentityCredentials(
{ IdentityPoolId: c.AWS.identityPoolId,
Logins: {'graph.facebook.com': fbresponse.authResponse.accessToken }
});
AWS.config.credentials.get(function(){
var signedUrl = getSignedUrl();
initClient(signedUrl);
});
var requestUrl = 'wss://' + host + canonicalUri + '?' + canonicalQuerystring;
//Authenticated
//After fb.login
Connect through JavaScript
function initClient(requestUrl) {
var clientId = String(Math.random()).replace('.', '');
var client = new Paho.MQTT.Client(requestUrl, clientId);
mqttClient = client;
var connectOptions = {
onSuccess: function() {
client.subscribe(topiclightbulb);
client.subscribe(topicgrove);
},
useSSL: true, timeout: 3, mqttVersion: 4,
onFailure: function() { console.error('connect failed'); }
};
client.connect(connectOptions);
client.onConnectionLost = onConnectionLost;
client.onMessageArrived = onMessageArrived;
}
//Subscribe topics
//Subscribe topics
Authenticated access for end-users
Amazon
Cognito
AWS STS
AWS IAM
permissions
role
WebSocket Connect
temporary
security
credentials
Allowed?
Yes!
IoT
topic
IoT
shadow
IoT
policy
Authenticated access for end-users
Amazon
Cognito
AWS STS
AWS IAM
permissions
role
WebSocket Connect
temporary
security
credentials
Allowed?
Yes!
IoT
topic
IoT
shadow
IoT
policy
Create, Attach
Policy for Alice,
Bob, and Chuck

Recommended for you

3 Easy Steps to Building Large-Scale IoT Architectures
3 Easy Steps to Building Large-Scale IoT Architectures3 Easy Steps to Building Large-Scale IoT Architectures
3 Easy Steps to Building Large-Scale IoT Architectures

You have already started connecting your devices to AWS IoT. You can control them from the cloud. And you can collect, store and analyse data from all your devices in the cloud. So far so good, but you now need to build an architecture that will serve millions of users and devices concurrently. In this session, Jan will explain how you can build a real world IoT architecture that serves millions of devices. The talk will focus on user and device onboarding, device and user access management, message exchange and end user access to live and historical data stored in the cloud. Learning objectives: - Learn simple steps to build a real-world IoT architecture that serves millions of devices - Understand how to onboard and manage users and IoT devices and to access live and historial data in the cloud

innovation-webinars-2017
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim CruseAWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse

AWS IoT and building an Internet connected camera. The document discusses connecting physical devices to AWS IoT using MQTT or HTTP protocols for secure communication. It describes using AWS IoT services like the rules engine to route messages, device shadows to sync state, and device registry for identity management. It provides an example of building an Internet connected camera with Raspberry Pi that takes pictures on button press and uploads to S3, notifying users via subscribed topics.

aws innovate 2016
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...

The growing popularity and breadth of use cases for IoT are challenging the traditional thinking of how data is acquired, processed, and analyzed to quickly gain insights and act promptly. Today, the potential of this data remains largely untapped. In this session, we explore architecture patterns for building comprehensive IoT analytics solutions using AWS big data services. We walk through two production-ready implementations. First, we present an end-to-end solution using AWS IoT, Amazon Kinesis, and AWS Lambda. Next, Hello discusses their consumer IoT solution built on top of Amazon Kinesis, Amazon DynamoDB, and Amazon Redshift.

cloud computingaws cloudre:invent
Authenticated
• End-users sign in
• Customize user-specific policy
in AWS IoT
• Users cannot access AWS IoT
until IoT policy is attached
Cognito Identities in AWS IoT
Unauthenticated
• No sign-in (anonymous)
• Use IAM role policy and policy
variables to restrict access
• No user-specific policy
in AWS IoT
Chicken and egg: when to attach the policy?
• Users cannot connect until they have a policy in IoT
• Policy cannot be attached without knowing the user’s
CognitoId
Solution: attach a policy when the user first connects!
On-demand registration
Amazon
Cognito
AWS
Lambda
CONNECT
Access denied
New User
(already
signed in)
Get Credentials
temporary
security
credentials
(no policy for user)
On-demand registration (continued)
Amazon
Cognito
AWS
Lambda
Register()Create, Attach
Policy
New User
IoT
policy
CONNECT
OK!
context.identity.cognitoIdentityId

Recommended for you

Secure Content Delivery Using Amazon CloudFront
Secure Content Delivery Using Amazon CloudFrontSecure Content Delivery Using Amazon CloudFront
Secure Content Delivery Using Amazon CloudFront

Whether you are building an e-commerce site or a business application, security is a key consideration when architecting your website or application. In this session, you will learn more about some of the things CloudFront does behind the scenes to protect the delivery of your content such as OCSP Stapling and Perfect Forward Secrecy. We will also share best practices on how you can use CloudFront to securely deliver content end-to-end, control who accesses your content, how to shield your origins from the Internet, and getting a A+ on SSL labs.

taipeiaws summit 2016aws cloud
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"

Solstice and Amazon Web Services (AWS) will present the benefits and use cases of edge computing, including an overview AWS IoT and the newly launched AWS Greengrass. AWS IoT closes the gap between physical and digital with things, internet and connectivity. AWSGreengrass enables connected devices running on AWS’s technology to process data locally-- reducing latency, allowing offline functionality, improving security, and more. We’ll share best practices for building with edge computing and Greengrass, and how you can apply it to your current and future IoT solutions. Solstice will also walk through a real-life implementation of AWS IoT and AWS Greengrass that was showcased at AWS re:Invent 2016. Speakers: • Chris Munns, Senior Developer Advocate, AWS • Andrew Whiting, VP of Business Development, Solstice • Pat Smolen, Sr. Technical Consultant, Solstice.

"aws lambda" greengrass solsticeawsiot
In Depth: AWS IAM and VPC
In Depth: AWS IAM and VPCIn Depth: AWS IAM and VPC
In Depth: AWS IAM and VPC

Presentation from AWS Worldwide Public Sector team's conference Building and Securing Applications in the Cloud (http://aws.amazon.com/campaigns/building-securing-applications-cloud/).

public sectorsecurityaws
Lambda Code – Attach Principal Policy
'use strict';
var AWS = require('aws-sdk');
AWS.config.region = 'us-east-1';
var iot = new AWS.Iot();
exports.handler = (event, context, callback) => {
var cognitoid = ‘';
if (typeof context.identity !== 'undefined') {
cognitoid = context.identity.cognitoIdentityId;
var params = {
policyName: 'cognito-user-access', /* required */
principal: cognitoid /* required */
};
iot.attachPrincipalPolicy(params, function(err, data) {
if (err) console.log(err, err.stack); // an error occurred
else console.log(data); // successful response
});
}
};
What permissions to attach?
• Start with minimal permissions
• Dynamically generate or attach your policy base on user
Wrapping up
• WebSockets makes IoT interactive
• Authentication for humans is different than devices
• Use Lambda to drive user registration, pairing
• Getting started with the AWS IoT Device SDK is easy
• AWS IoT WebSockets, Rules Engine, Shadow and
Lambda makes server-less applications easy
Thank you!
Dickson Yue

Recommended for you

Amazon Cognito Deep Dive
Amazon Cognito Deep DiveAmazon Cognito Deep Dive
Amazon Cognito Deep Dive

by Fritz Kunstler, Sr. AWS Security Consultant AWS Join us for four days of security and compliance sessions and hands-on labs led by our AWS security pros during AWS Security Week at the San Francisco Loft. Join us for all four days, or pick just the days that are most relevant to you. We'll open on Monday with Security 101 day, followed by sessions Tuesday on Identity and Access Management, our popular Threat Detection and Remediation day Wednesday will feature an updated GuardDuty lab, and we'll end Thursday with Incident Response sessions, labs, and a talk by Netflix on their new open source IR tool. This week will also feature Dome9 as a sponsor, and you can hear them speak and present a hands-on workshop Monday during Security 101 day.

awsamazon webservicescloud
The Lifecycle of an AWS IoT Thing
The Lifecycle of an AWS IoT ThingThe Lifecycle of an AWS IoT Thing
The Lifecycle of an AWS IoT Thing

AWS IoT is a managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices. This webinar will introduce the lifecycle of an IoT thing and the mechanisms used by AWS IoT to manage things. These mechanisms can be used to securely build and provision things, manage deployment, manage thing health, and integrate with other AWS services. And when the life of the thing has come to an end, we will show you how to retire the thing, keeping your solution secure. Learning Objectives: • Common IoT Thing Management Issues • AWS IoT Security and Access Control Mechanisms Who Should Attend: • Technical Decision Makers, Developers, Makers

internet of thingsiot thingsamazon
Srv204 Getting Started with AWS IoT
Srv204 Getting Started with AWS IoTSrv204 Getting Started with AWS IoT
Srv204 Getting Started with AWS IoT

AWS IoT is a managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices. In this tech talk, we will discuss how constrained devices can leverage AWS IoT to send data to the cloud and receive commands back to the device from the cloud using the protocol of their choice. We will use the AWS IoT Starter Kit to demonstrate building a real connected product, securely connect with AWS IoT using MQTT, WebSockets, and HTTP protocols, and show how developers and businesses can leverage features of AWS IoT like Device Shadows and the Rules Engine, which provides message processing and integration with other AWS services.

#aws#srv204#chisummit2017

More Related Content

What's hot

클라우드로 데이터 센터 확장하기 : 하이브리드 환경을 위한 연결 옵션 및 고려사항::강동환::AWS Summit Seoul 2018
클라우드로 데이터 센터 확장하기 : 하이브리드 환경을 위한 연결 옵션 및 고려사항::강동환::AWS Summit Seoul 2018 클라우드로 데이터 센터 확장하기 : 하이브리드 환경을 위한 연결 옵션 및 고려사항::강동환::AWS Summit Seoul 2018
클라우드로 데이터 센터 확장하기 : 하이브리드 환경을 위한 연결 옵션 및 고려사항::강동환::AWS Summit Seoul 2018
Amazon Web Services Korea
 
[2017 AWS Startup Day] AWS 비용 최대 90% 절감하기: 스팟 인스턴스 Deep-Dive
[2017 AWS Startup Day] AWS 비용 최대 90% 절감하기: 스팟 인스턴스 Deep-Dive [2017 AWS Startup Day] AWS 비용 최대 90% 절감하기: 스팟 인스턴스 Deep-Dive
[2017 AWS Startup Day] AWS 비용 최대 90% 절감하기: 스팟 인스턴스 Deep-Dive
Amazon Web Services Korea
 
OpenID Connect: An Overview
OpenID Connect: An OverviewOpenID Connect: An Overview
OpenID Connect: An Overview
Pat Patterson
 
The Future is Now: The ForgeRock Identity Platform, Early 2017 Release
The Future is Now: The ForgeRock Identity Platform, Early 2017 ReleaseThe Future is Now: The ForgeRock Identity Platform, Early 2017 Release
The Future is Now: The ForgeRock Identity Platform, Early 2017 Release
ForgeRock
 
Introduction to Azure AD and Azure AD B2C
Introduction to Azure AD and Azure AD B2CIntroduction to Azure AD and Azure AD B2C
Introduction to Azure AD and Azure AD B2C
Joonas Westlin
 
Cognito Customer Deep Dive
Cognito Customer Deep DiveCognito Customer Deep Dive
Cognito Customer Deep Dive
Amazon Web Services
 
OAuth & OpenID Connect Deep Dive
OAuth & OpenID Connect Deep DiveOAuth & OpenID Connect Deep Dive
OAuth & OpenID Connect Deep Dive
Nordic APIs
 
OAuth2 - Introduction
OAuth2 - IntroductionOAuth2 - Introduction
OAuth2 - Introduction
Knoldus Inc.
 
Content Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso
Content Delivery Using Amazon CloudFront - AWS Presentation - John MancusoContent Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso
Content Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso
Amazon Web Services
 
Security Best Practices on AWS
Security Best Practices on AWSSecurity Best Practices on AWS
Security Best Practices on AWS
Amazon Web Services
 
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...
Amazon Web Services Korea
 
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...
Amazon Web Services
 
Creating Event Driven Applications with Azure Event Grid
Creating Event Driven Applications with Azure Event GridCreating Event Driven Applications with Azure Event Grid
Creating Event Driven Applications with Azure Event Grid
Callon Campbell
 
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...
Amazon Web Services Korea
 
Deploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerDeploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control Tower
Amazon Web Services
 
Amazon CloudFront 101
Amazon CloudFront 101Amazon CloudFront 101
Amazon CloudFront 101
Amazon Web Services
 
100.RED HAT SINGLE SIGN-ON
100.RED HAT SINGLE SIGN-ON100.RED HAT SINGLE SIGN-ON
100.RED HAT SINGLE SIGN-ON
Opennaru, inc.
 
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터
Amazon Web Services Korea
 
Azure Security Overview
Azure Security OverviewAzure Security Overview
Azure Security Overview
Allen Brokken
 
AWS Security
AWS SecurityAWS Security
AWS Security
Amazon Web Services
 

What's hot (20)

클라우드로 데이터 센터 확장하기 : 하이브리드 환경을 위한 연결 옵션 및 고려사항::강동환::AWS Summit Seoul 2018
클라우드로 데이터 센터 확장하기 : 하이브리드 환경을 위한 연결 옵션 및 고려사항::강동환::AWS Summit Seoul 2018 클라우드로 데이터 센터 확장하기 : 하이브리드 환경을 위한 연결 옵션 및 고려사항::강동환::AWS Summit Seoul 2018
클라우드로 데이터 센터 확장하기 : 하이브리드 환경을 위한 연결 옵션 및 고려사항::강동환::AWS Summit Seoul 2018
 
[2017 AWS Startup Day] AWS 비용 최대 90% 절감하기: 스팟 인스턴스 Deep-Dive
[2017 AWS Startup Day] AWS 비용 최대 90% 절감하기: 스팟 인스턴스 Deep-Dive [2017 AWS Startup Day] AWS 비용 최대 90% 절감하기: 스팟 인스턴스 Deep-Dive
[2017 AWS Startup Day] AWS 비용 최대 90% 절감하기: 스팟 인스턴스 Deep-Dive
 
OpenID Connect: An Overview
OpenID Connect: An OverviewOpenID Connect: An Overview
OpenID Connect: An Overview
 
The Future is Now: The ForgeRock Identity Platform, Early 2017 Release
The Future is Now: The ForgeRock Identity Platform, Early 2017 ReleaseThe Future is Now: The ForgeRock Identity Platform, Early 2017 Release
The Future is Now: The ForgeRock Identity Platform, Early 2017 Release
 
Introduction to Azure AD and Azure AD B2C
Introduction to Azure AD and Azure AD B2CIntroduction to Azure AD and Azure AD B2C
Introduction to Azure AD and Azure AD B2C
 
Cognito Customer Deep Dive
Cognito Customer Deep DiveCognito Customer Deep Dive
Cognito Customer Deep Dive
 
OAuth & OpenID Connect Deep Dive
OAuth & OpenID Connect Deep DiveOAuth & OpenID Connect Deep Dive
OAuth & OpenID Connect Deep Dive
 
OAuth2 - Introduction
OAuth2 - IntroductionOAuth2 - Introduction
OAuth2 - Introduction
 
Content Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso
Content Delivery Using Amazon CloudFront - AWS Presentation - John MancusoContent Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso
Content Delivery Using Amazon CloudFront - AWS Presentation - John Mancuso
 
Security Best Practices on AWS
Security Best Practices on AWSSecurity Best Practices on AWS
Security Best Practices on AWS
 
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...
AWS Fargate와 Amazon ECS를 사용한 CI/CD 베스트 프랙티스 - 유재석, AWS 솔루션즈 아키텍트 :: AWS Build...
 
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...
Amazon Virtual Private Cloud (VPC): Networking Fundamentals and Connectivity ...
 
Creating Event Driven Applications with Azure Event Grid
Creating Event Driven Applications with Azure Event GridCreating Event Driven Applications with Azure Event Grid
Creating Event Driven Applications with Azure Event Grid
 
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...
AWS 클라우드 핵심 서비스로 클라우드 기반 아키텍처 빠르게 구성하기 - 문종민 솔루션즈 아키텍트, AWS :: AWS Summit Seo...
 
Deploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerDeploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control Tower
 
Amazon CloudFront 101
Amazon CloudFront 101Amazon CloudFront 101
Amazon CloudFront 101
 
100.RED HAT SINGLE SIGN-ON
100.RED HAT SINGLE SIGN-ON100.RED HAT SINGLE SIGN-ON
100.RED HAT SINGLE SIGN-ON
 
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터
AWS Builders - Industry Edition: DevSecOps on AWS - 시작은 IAM 부터
 
Azure Security Overview
Azure Security OverviewAzure Security Overview
Azure Security Overview
 
AWS Security
AWS SecurityAWS Security
AWS Security
 

Viewers also liked

Building an AI-based service with Rekognition, Polly and Lex
Building an AI-based service with Rekognition, Polly and LexBuilding an AI-based service with Rekognition, Polly and Lex
Building an AI-based service with Rekognition, Polly and Lex
Amazon Web Services
 
Real-time Chat Backend on AWS IoT 20160422
Real-time Chat Backend on AWS IoT 20160422Real-time Chat Backend on AWS IoT 20160422
Real-time Chat Backend on AWS IoT 20160422
akitsukada
 
Real-Time Event Processing
Real-Time Event ProcessingReal-Time Event Processing
Real-Time Event Processing
Amazon Web Services
 
A guide on Aws Security Token Service
A guide on Aws Security Token ServiceA guide on Aws Security Token Service
A guide on Aws Security Token Service
Blazeclan Technologies Private Limited
 
CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング
CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキングCloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング
CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング
Kiyonori Kitasako
 
AWS Black Belt Tech シリーズ 2015 - AWS IoT
AWS Black Belt Tech シリーズ 2015 - AWS IoTAWS Black Belt Tech シリーズ 2015 - AWS IoT
AWS Black Belt Tech シリーズ 2015 - AWS IoT
Amazon Web Services Japan
 

Viewers also liked (6)

Building an AI-based service with Rekognition, Polly and Lex
Building an AI-based service with Rekognition, Polly and LexBuilding an AI-based service with Rekognition, Polly and Lex
Building an AI-based service with Rekognition, Polly and Lex
 
Real-time Chat Backend on AWS IoT 20160422
Real-time Chat Backend on AWS IoT 20160422Real-time Chat Backend on AWS IoT 20160422
Real-time Chat Backend on AWS IoT 20160422
 
Real-Time Event Processing
Real-Time Event ProcessingReal-Time Event Processing
Real-Time Event Processing
 
A guide on Aws Security Token Service
A guide on Aws Security Token ServiceA guide on Aws Security Token Service
A guide on Aws Security Token Service
 
CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング
CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキングCloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング
CloudFrontで実現するセキュアコンテンツ配信と効果のトラッキング
 
AWS Black Belt Tech シリーズ 2015 - AWS IoT
AWS Black Belt Tech シリーズ 2015 - AWS IoTAWS Black Belt Tech シリーズ 2015 - AWS IoT
AWS Black Belt Tech シリーズ 2015 - AWS IoT
 

Similar to Building Powerful IoT Apps with AWS IoT and Websockets

Developing Connected Applications with AWS IoT - Technical 301
Developing Connected Applications with AWS IoT - Technical 301Developing Connected Applications with AWS IoT - Technical 301
Developing Connected Applications with AWS IoT - Technical 301
Amazon Web Services
 
Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"
Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"
Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"
AWS Chicago
 
Best Practices for IoT Security in the Cloud
Best Practices for IoT Security in the Cloud Best Practices for IoT Security in the Cloud
Best Practices for IoT Security in the Cloud
Amazon Web Services
 
Best Practices with IoT Security - February Online Tech Talks
Best Practices with IoT Security - February Online Tech TalksBest Practices with IoT Security - February Online Tech Talks
Best Practices with IoT Security - February Online Tech Talks
Amazon Web Services
 
3 Easy Steps to Building Large-Scale IoT Architectures
3 Easy Steps to Building Large-Scale IoT Architectures3 Easy Steps to Building Large-Scale IoT Architectures
3 Easy Steps to Building Large-Scale IoT Architectures
Amazon Web Services
 
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim CruseAWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse
Amazon Web Services Korea
 
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...
Amazon Web Services
 
Secure Content Delivery Using Amazon CloudFront
Secure Content Delivery Using Amazon CloudFrontSecure Content Delivery Using Amazon CloudFront
Secure Content Delivery Using Amazon CloudFront
Amazon Web Services
 
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"
Chris Munns
 
In Depth: AWS IAM and VPC
In Depth: AWS IAM and VPCIn Depth: AWS IAM and VPC
In Depth: AWS IAM and VPC
Amazon Web Services
 
Amazon Cognito Deep Dive
Amazon Cognito Deep DiveAmazon Cognito Deep Dive
Amazon Cognito Deep Dive
Amazon Web Services
 
The Lifecycle of an AWS IoT Thing
The Lifecycle of an AWS IoT ThingThe Lifecycle of an AWS IoT Thing
The Lifecycle of an AWS IoT Thing
Amazon Web Services
 
Srv204 Getting Started with AWS IoT
Srv204 Getting Started with AWS IoTSrv204 Getting Started with AWS IoT
Srv204 Getting Started with AWS IoT
Amazon Web Services
 
Workshop AWS IoT @ IoT World Paris
Workshop AWS IoT @ IoT World ParisWorkshop AWS IoT @ IoT World Paris
Workshop AWS IoT @ IoT World Paris
Julien SIMON
 
Serverless Data Processing on AWS - Level 300
Serverless Data Processing on AWS - Level 300Serverless Data Processing on AWS - Level 300
Serverless Data Processing on AWS - Level 300
Amazon Web Services
 
Getting the Most Value from Your Aviatrix Controller & Gateways
Getting the Most Value from Your Aviatrix Controller & GatewaysGetting the Most Value from Your Aviatrix Controller & Gateways
Getting the Most Value from Your Aviatrix Controller & Gateways
Khash Nakhostin
 
Secure Content Delivery Using Amazon CloudFront and AWS WAF
Secure Content Delivery Using Amazon CloudFront and AWS WAFSecure Content Delivery Using Amazon CloudFront and AWS WAF
Secure Content Delivery Using Amazon CloudFront and AWS WAF
Amazon Web Services
 
Secure Content Delivery Using Amazon CloudFront and AWS WAF
Secure Content Delivery Using Amazon CloudFront and AWS WAFSecure Content Delivery Using Amazon CloudFront and AWS WAF
Secure Content Delivery Using Amazon CloudFront and AWS WAF
Amazon Web Services
 
Serverless identity management, authentication, and authorization - SDD405-R ...
Serverless identity management, authentication, and authorization - SDD405-R ...Serverless identity management, authentication, and authorization - SDD405-R ...
Serverless identity management, authentication, and authorization - SDD405-R ...
Amazon Web Services
 
Connecting microcontrollers to the cloud using MQTT, BLE, and HTTP
Connecting microcontrollers to the cloud using MQTT, BLE, and HTTPConnecting microcontrollers to the cloud using MQTT, BLE, and HTTP
Connecting microcontrollers to the cloud using MQTT, BLE, and HTTP
All Things Open
 

Similar to Building Powerful IoT Apps with AWS IoT and Websockets (20)

Developing Connected Applications with AWS IoT - Technical 301
Developing Connected Applications with AWS IoT - Technical 301Developing Connected Applications with AWS IoT - Technical 301
Developing Connected Applications with AWS IoT - Technical 301
 
Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"
Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"
Jeremy Cowan's AWS user group presentation "AWS Greengrass & IoT demo"
 
Best Practices for IoT Security in the Cloud
Best Practices for IoT Security in the Cloud Best Practices for IoT Security in the Cloud
Best Practices for IoT Security in the Cloud
 
Best Practices with IoT Security - February Online Tech Talks
Best Practices with IoT Security - February Online Tech TalksBest Practices with IoT Security - February Online Tech Talks
Best Practices with IoT Security - February Online Tech Talks
 
3 Easy Steps to Building Large-Scale IoT Architectures
3 Easy Steps to Building Large-Scale IoT Architectures3 Easy Steps to Building Large-Scale IoT Architectures
3 Easy Steps to Building Large-Scale IoT Architectures
 
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim CruseAWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse
AWS Innovate: Building an Internet Connected Camera with AWS IoT- Tim Cruse
 
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...
AWS re:Invent 2016: Understanding IoT Data: How to Leverage Amazon Kinesis in...
 
Secure Content Delivery Using Amazon CloudFront
Secure Content Delivery Using Amazon CloudFrontSecure Content Delivery Using Amazon CloudFront
Secure Content Delivery Using Amazon CloudFront
 
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"
AWS NYC Meetup - May 2017 - "AWS IoT and Greengrass"
 
In Depth: AWS IAM and VPC
In Depth: AWS IAM and VPCIn Depth: AWS IAM and VPC
In Depth: AWS IAM and VPC
 
Amazon Cognito Deep Dive
Amazon Cognito Deep DiveAmazon Cognito Deep Dive
Amazon Cognito Deep Dive
 
The Lifecycle of an AWS IoT Thing
The Lifecycle of an AWS IoT ThingThe Lifecycle of an AWS IoT Thing
The Lifecycle of an AWS IoT Thing
 
Srv204 Getting Started with AWS IoT
Srv204 Getting Started with AWS IoTSrv204 Getting Started with AWS IoT
Srv204 Getting Started with AWS IoT
 
Workshop AWS IoT @ IoT World Paris
Workshop AWS IoT @ IoT World ParisWorkshop AWS IoT @ IoT World Paris
Workshop AWS IoT @ IoT World Paris
 
Serverless Data Processing on AWS - Level 300
Serverless Data Processing on AWS - Level 300Serverless Data Processing on AWS - Level 300
Serverless Data Processing on AWS - Level 300
 
Getting the Most Value from Your Aviatrix Controller & Gateways
Getting the Most Value from Your Aviatrix Controller & GatewaysGetting the Most Value from Your Aviatrix Controller & Gateways
Getting the Most Value from Your Aviatrix Controller & Gateways
 
Secure Content Delivery Using Amazon CloudFront and AWS WAF
Secure Content Delivery Using Amazon CloudFront and AWS WAFSecure Content Delivery Using Amazon CloudFront and AWS WAF
Secure Content Delivery Using Amazon CloudFront and AWS WAF
 
Secure Content Delivery Using Amazon CloudFront and AWS WAF
Secure Content Delivery Using Amazon CloudFront and AWS WAFSecure Content Delivery Using Amazon CloudFront and AWS WAF
Secure Content Delivery Using Amazon CloudFront and AWS WAF
 
Serverless identity management, authentication, and authorization - SDD405-R ...
Serverless identity management, authentication, and authorization - SDD405-R ...Serverless identity management, authentication, and authorization - SDD405-R ...
Serverless identity management, authentication, and authorization - SDD405-R ...
 
Connecting microcontrollers to the cloud using MQTT, BLE, and HTTP
Connecting microcontrollers to the cloud using MQTT, BLE, and HTTPConnecting microcontrollers to the cloud using MQTT, BLE, and HTTP
Connecting microcontrollers to the cloud using MQTT, BLE, and HTTP
 

More from Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
Amazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
Amazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
Amazon Web Services
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Amazon Web Services
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
Amazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
Amazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Amazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
Amazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Amazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
Amazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
Amazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
Amazon Web Services
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
Amazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
Amazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
Amazon Web Services
 

More from Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 

Building Powerful IoT Apps with AWS IoT and Websockets

  • 1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Dickson Yue, AWS Solutions Architect 9/15/2017 Building Powerful IoT apps with AWS IoT and Websockets AWS Startup Day – Hong Kong
  • 2. Outline • MQTT recap • WebSockets: what and why? • Authentication and Authorization • Demo + Code
  • 4. Publish / Subscribe Standard Protocol Support MQTT, HTTP, WebSockets Long Lived Connections Receive signals from the cloud Secure by Default Connect securely via X509 Certs and TLS 1.2 Client Mutual Auth
  • 5. MQTT PubSub Topic Subscriptions PUBLISH weather-station/echo-base/temperature SUBSCRIBE weather-station/echo-base/temperature weather-station/echo-base/# weather-station/+/temperature
  • 6. Comparing protocols MQTT • Lightweight • Bidirectional HTTP • Broad support (browsers) • Request-reply Client Server Client Server
  • 7. AWS IoT protocol comparison Capability MQTT HTTP Publish Yes Yes Subscribe Yes No
  • 8. WebSockets to the rescue GET wss://…/mqtt?X-Amz-Signature=… Connection: Upgrade Sec-WebSocket-Protocol: mqtt … Upgrade? OK HTTP/1.1 101 Switching Protocols Connection: Upgrade HTTP
  • 9. WebSockets to the rescue HTTP MQTT SUBSCRIBE PUBLISH …
  • 10. AWS IoT protocol comparison *Using WebSockets to upgrade HTTP connections to MQTT connections Capability MQTT HTTP Publish Yes Yes Subscribe Yes Yes*
  • 11. Outline • MQTT recap • WebSockets: what and why? • Authentication and Authorization • Demo + Code
  • 13. Authentication vs authorization Authentication: Prove your identity Authorization: Restrict access
  • 14. Authentication for devices Device credentials • Private key (authenticate the device) • Certificate (register the device with IoT) • Root CA cert (authenticate IoT)
  • 16. Connect through MQTT libary import paho.mqtt.client as mqtt def init(): global client try: client = mqtt.Client() client.on_connect = on_connect client.on_message = on_message client.clientid = clientid client.tls_set( "../../certs/root.pem", certfile="../../certs/grove-cert.pem", keyfile="../../certs/grove-privateKey.pem", tls_version=ssl.PROTOCOL_TLSv1_2, ciphers=None ) client.connect("data.iot.us-east-1.amazonaws.com", 8883, 10) client.loop_forever() except: print "Mqtt Unexpected error:", sys.exc_info()[0]
  • 17. HTTP curl --tlsv1.2 --cacert root.pem --cert pi01-cert.pem --key pi01-privateKey.pem -X POST -d "{ "serialNumber": "G030JF053216F1BS", "clickType": "SINGLE", "batteryVoltage": "2000mV" }" "https://a1omffl4uase1e.iot.us-east- 1.amazonaws.com:8443/topics/iotbutton/virtualButton?qos=1"
  • 18. AWS IoT protocol comparison Capability MQTT HTTP Publish Yes Yes Subscribe Yes No Certificate Auth Yes Yes Sig V4 Auth No Yes
  • 19. AWS IoT protocol comparison Capability MQTT HTTP Publish Yes Yes Subscribe Yes No Certificate Auth Yes Yes Sig V4 Auth No Yes
  • 20. AWS IoT protocol comparison Capability MQTT HTTP Publish Yes Yes Subscribe Yes Yes* Certificate Auth Yes Yes Sig V4 Auth Yes* Yes *Using WebSockets to upgrade HTTP connections to MQTT connections
  • 21. Authenticated • End-users sign in • Customize user-specific policy in AWS IoT • Users cannot access AWS IoT until IoT policy is attached Cognito Identities in AWS IoT Unauthenticated • No sign-in (anonymous) • Use IAM role policy and policy variables to restrict access • No user-specific policy in AWS IoT
  • 23. Unauthenticated access for end-users Amazon Cognito Get Credentials AssumeRole
  • 24. Connect through JavaScript var region = c.AWS.region; //'ap-northeast-1' var iotEndpoint = c.AWS.iotEndpoint; var identityPoolId = c.AWS.identityPoolId; AWS.config.region = region; AWS.config.credentials = new AWS.CognitoIdentityCredentials({ IdentityPoolId: identityPoolId }); AWS.config.credentials.get(function(){ var signedUrl = getSignedUrl(); initClient(signedUrl); }); var requestUrl = 'wss://' + host + canonicalUri + '?' + canonicalQuerystring; //Unauthenticated
  • 25. Unauthenticated access for end-users Amazon Cognito Get Credentials AssumeRole AWS STS AWS IAM permissions role temporary security credentials
  • 26. Unauthenticated access for end-users Amazon Cognito AWS STS AWS IAM permissions role WebSocket Connect temporary security credentials Allowed? Yes!
  • 27. User-specific policies { "Effect": "Allow", "Action": ["iot:Publish", "iot:Subscribe"] "Resource": [ "arn:*:topic/home/123_aws_ave", "arn:*:topicfilter/home/123_aws_ave" ] } { "Effect": "Allow", "Action": ["iot:Publish", "iot:Subscribe"] "Resource": [ "arn:*:topic/home/456_iot_ln", "arn:*:topicfilter/home/456_iot_ln" ] } Policy for Alice, Bob: Policy for Chuck:
  • 28. Fine-grained access control SUB home/456_iot_ln SUB home/123_aws_ave/# PUB home/123_aws_ave/light_1/on SUB home/123_aws_ave/# PUB home/123_aws_ave/door_1/open Alice Bob Chuck
  • 29. Fine-grained access control PUB home/123_aws_ave/door_1/open SUB home/123_aws_ave/# PUB home/123_aws_ave/light_1/on SUB home/123_aws_ave/# PUB home/123_aws_ave/door_1/open Alice Bob Chuck
  • 30. Policy variables for Cognito users AWS IAM PUBLISH foo/us-east-1:abcdef-my-cognito-id temporary security credentials { "Effect": "Allow", "Action": "iot:Publish", "Resource": [ "arn:*:topic/foo/${cognito-identity.amazonaws.com:sub}" ] }
  • 31. Policy variables for Cognito users { "Effect": "Allow", "Action": "iot:Publish", "Resource": [ "arn:*:topic/foo/${cognito-identity.amazonaws.com:sub}" ] } AWS.config.region = 'us-east-1'; AWS.config.credentials = new AWS.CognitoIdentityCredentials({ IdentityPoolId: 'us-east-1:YOUR_IDENTITY_POOL_ID' }); AWS.config.credentials.get(function(err)) { if (err) { return; } var cognitoId = AWS.config.credentials.identityId; mqttClient.connect(...); mqttClient.publish('foo/' + cognitoId); }); permissions role
  • 32. Outline • MQTT recap • WebSockets: what and why? • Authentication and Authorization • Demo + Code
  • 35. Configuring Cognito with AWS IoT UnauthenticatedAuthenticated
  • 36. Authenticated access for end-users Amazon Cognito Get Credentials temporary security credentials AWS STSAWS IAM permissions role temporary security credentials
  • 37. Connect through JavaScript var region = c.AWS.region; //'ap-northeast-1' var iotEndpoint = c.AWS.iotEndpoint; var identityPoolId = c.AWS.identityPoolId; AWS.config.region = region; AWS.config.credentials = new AWS.CognitoIdentityCredentials( { IdentityPoolId: c.AWS.identityPoolId, Logins: {'graph.facebook.com': fbresponse.authResponse.accessToken } }); AWS.config.credentials.get(function(){ var signedUrl = getSignedUrl(); initClient(signedUrl); }); var requestUrl = 'wss://' + host + canonicalUri + '?' + canonicalQuerystring; //Authenticated //After fb.login
  • 38. Connect through JavaScript function initClient(requestUrl) { var clientId = String(Math.random()).replace('.', ''); var client = new Paho.MQTT.Client(requestUrl, clientId); mqttClient = client; var connectOptions = { onSuccess: function() { client.subscribe(topiclightbulb); client.subscribe(topicgrove); }, useSSL: true, timeout: 3, mqttVersion: 4, onFailure: function() { console.error('connect failed'); } }; client.connect(connectOptions); client.onConnectionLost = onConnectionLost; client.onMessageArrived = onMessageArrived; } //Subscribe topics //Subscribe topics
  • 39. Authenticated access for end-users Amazon Cognito AWS STS AWS IAM permissions role WebSocket Connect temporary security credentials Allowed? Yes! IoT topic IoT shadow IoT policy
  • 40. Authenticated access for end-users Amazon Cognito AWS STS AWS IAM permissions role WebSocket Connect temporary security credentials Allowed? Yes! IoT topic IoT shadow IoT policy Create, Attach Policy for Alice, Bob, and Chuck
  • 41. Authenticated • End-users sign in • Customize user-specific policy in AWS IoT • Users cannot access AWS IoT until IoT policy is attached Cognito Identities in AWS IoT Unauthenticated • No sign-in (anonymous) • Use IAM role policy and policy variables to restrict access • No user-specific policy in AWS IoT
  • 42. Chicken and egg: when to attach the policy? • Users cannot connect until they have a policy in IoT • Policy cannot be attached without knowing the user’s CognitoId Solution: attach a policy when the user first connects!
  • 43. On-demand registration Amazon Cognito AWS Lambda CONNECT Access denied New User (already signed in) Get Credentials temporary security credentials (no policy for user)
  • 44. On-demand registration (continued) Amazon Cognito AWS Lambda Register()Create, Attach Policy New User IoT policy CONNECT OK! context.identity.cognitoIdentityId
  • 45. Lambda Code – Attach Principal Policy 'use strict'; var AWS = require('aws-sdk'); AWS.config.region = 'us-east-1'; var iot = new AWS.Iot(); exports.handler = (event, context, callback) => { var cognitoid = ‘'; if (typeof context.identity !== 'undefined') { cognitoid = context.identity.cognitoIdentityId; var params = { policyName: 'cognito-user-access', /* required */ principal: cognitoid /* required */ }; iot.attachPrincipalPolicy(params, function(err, data) { if (err) console.log(err, err.stack); // an error occurred else console.log(data); // successful response }); } };
  • 46. What permissions to attach? • Start with minimal permissions • Dynamically generate or attach your policy base on user
  • 47. Wrapping up • WebSockets makes IoT interactive • Authentication for humans is different than devices • Use Lambda to drive user registration, pairing • Getting started with the AWS IoT Device SDK is easy • AWS IoT WebSockets, Rules Engine, Shadow and Lambda makes server-less applications easy