- Welcome 'Back to Basics'.
In this episode, I'll show you an architectural pattern
that helped me to onboard Internet of Things (IoT) devices at scale.
Recently, while working on an IoT project
to monitor warehouses,
I faced the challenge of onboarding thousands of devices
across different regions.
Additionally, the cybersecurity requirements
varied from region to region.
In this use case, the IoT devices will be manufactured
by a third party, and to meet the requirements,
they would have to ship directly
from the manufacturer to the place of installation.
The third party manufactured devices
were not part of a cloud-managed public key infrastructure,
meaning they did not have a unique X509 certificate
trusted by AWS.
Devices in this stage must receive a trusted certificate
that is also signed by a trusted certificate authority
that is then registered with AWS.
A secure connection with TLS (transport layer security) has three requirements,
a unique device certificate in the IoT device,
the certificate registered in AWS,
and a certificate authority trusted by both sides.
AWS IoT Core helped me to overcome this challenge.
First, the third party device manufacturer
provides a certificate authority
of which all device certificates
have been signed during the manufacturing process,
which you register to AWS IoT Core.
Second, our devices then are programmed to connect
to the AWS IoT Core endpoint,
which has the certificate authority registered.
Upon the connection, requests by an unregistered device,
AWS IoT Core will confirm the device certificate signature.
If that matches the registered certificate authority,
the device will be provisioned
by one of the provisioning methods.
Provisioning flows with AWS IoT Core
can vary to meet different requirements,
fleet provisioning, just in time provisioning,
just in time registration,
or your custom authentication flow.
Regardless of which method,
the objective of a provisioning flow is to establish trust
and create cloud resources that represent the IoT device.
Those resources are created
based on a provisioning template, Lambda function,
or a combination of both.
At the end of provisioning flows,
you have a registered device certificate,
an IoT thing registry, and an IoT policy.
Additionally, the provisioning flow
can be used as a mechanism
for an event-driven cloud infrastructure.
AWS IoT Core is integrated with many other AWS services.
That integration helped me to solve another challenge.
In my use case, the application cloud resources,
such as the databases and EC2 instances
should only be provisioned
upon a new device registration.
In this case, the provision event can be used
to trigger calls to other services,
and therefore, provision resources for you.
EventBridge and CloudWatch
can be used to optimize those actions.
Also, by using AWS IoT Device Defender
and AWS IoT Device Management,
your device certificate rotation and firmware updates
can be scheduled and monitored, helping you
with your infrastructure's cybersecurity posture
and operational excellence.
It is essential to take the time
to plan how your device
will receive the necessary certificates
to interact with your cloud infrastructure.
And it is important to remember,
certificates are created and signed
during the manufacturing of the devices.
Check out the link below for more details.
Thank you for watching 'Back to Basics'.
See you next time.