You have already started connecting your devices to AWS IoT. You can control them from the cloud. And you can collect, store and analyse data from all your devices in the cloud. So far so good, but you now need to build an architecture that will serve millions of users and devices concurrently. In this session, Jan will explain how you can build a real world IoT architecture that serves millions of devices. The talk will focus on user and device onboarding, device and user access management, message exchange and end user access to live and historical data stored in the cloud. Learning objectives: - Learn simple steps to build a real-world IoT architecture that serves millions of devices - Understand how to onboard and manage users and IoT devices and to access live and historial data in the cloud

1. 3 Easy Steps
to Build Large Scale IoT Architectures
Jan Metzner
Specialist Solutions Architect IoT in EMEA

2. Learning Objectives for this session
• How to Automate and Scale Security
• How to Manage Namespaces and Relations
• Do something with the Generated Data

3. AWS IoT
Fully managed cloud platform that lets connected devices easily and securely
interact with cloud applications and other devices
Devices Network Security Data Collection Smarts
1
Connect Billions of
Devices
Lightweight Communication
Protocol
X509 Certificates DynamoDB, Kinesis,
and S3
Trigger Lambda
Functions

4. AWS IoT

5. One service, three protocols
MQTT + Mutual
Auth TLS
Websocket + AWS
Auth
HTTPS + AWS
Auth
Server auth TLS + cert TLS + cert TLS + cert
Client auth TLS + cert AWS credentials
(API keys)
AWS credentials
(API keys)
Confidentiality TLS TLS TLS
Protocol MQTT HTTP/WS HTTP
Communication
model
Pub/sub Pub/sub REST
Identification AWS ARNs AWS ARNs AWS ARNs
Authorization AWS policy AWS policy AWS policy

6. Question:
What kind of Iot platform do you want to build?

7. Device / User Security

8. Integrate and Authenticate “Things”
Certificate/private keyThings
Federation with Amazon CognitoUsers

9. Authorize “Things” – IoT Policies per Thing
Certificate/private key
Federation with Amazon Cognito
Things
Users

10. How to Scale the Security?
• Basic Policy Variables
iot:ClientId
• X.509 Certificate Policy Variables
iot:Certificate.Subject.CommonName
• Thing Policy Variables (from the Registry)
iot:Connection.Thing.Attributes[attributeName]
– Policy Variables

11. Authorization – IoT policies
Fine-grained access for each device with a single policy
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "iot:Connect",
"Resource": "arn:aws:iot:eu-west-1:1234567890:client/${iot:Certificate.Subject.CommonName.1}",
"Effect": "Allow”
}, {
"Action": "iot:Publish",
"Resource": [
"arn:aws:iot:eu-west-1:1234567890:topic/sensordata/${iot:Certificate.Subject.CommonName.1}",
"arn:aws:iot:eu-west-1:1234567890:topic/sensordata/${iot:Certificate.Subject.CommonName.1}/*”
],
"Effect": "Allow”
} ]
}

12. Authorization – IoT policies
Fine-grained access with registry variables
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "iot:Connect",
"Resource": ”*",
"Effect": "Allow”,
"Condition":{ "Bool":{ "iot:Connection.Thing.IsAttached ":["true"] } }
}, {
"Action": "iot:Publish",
"Resource": [
"arn:aws:iot:eu-west-1:1234567890:topic/
${iot:Connection.Thing.ThingTypeName}/${iot:Connection.Thing.ThingName}"
],
"Effect": "Allow”
} ]
}

13. Automate Certificate on Boarding
Manufacturing line
Provisioning of the Identities
signed with customer’s CA
First data connection
JIT registration

14. Manage Namespaces and Relations

15. Use of the IoT Registry build into AWS IoT
• Free of Charge
• Great for Fine Grained Permissions
• Can hold relations but
• Not meant for massive discovery/search
• Not to hold tons of additional Metadata

16. Architecture for Admin/Search/Discovery
End User API
Admin User API Lambda Function
Lambda Function
AWS IoT
Store for
Queries/Search/Discovery
modify IoT Policies
Registry
Store
Relations/Metadata

17. Simple Store: Amazon DynamoDB
End User API
Admin User API Lambda Function
Lambda Function
AWS IoT
Amazon DynamoDB
Store/Query
Relations/Metadata
modify IoT Policies
Registry

18. Complex Search: Amazon Elasticsearch Service
End User API
Admin User API Lambda Function
Lambda Function
AWS IoT
Amazon Elasticsearch
Service
Store/Query
Relations/Metadata
modify IoT Policies
Registry

19. Complex Hierarchies with Multiple Dimension
Amazon Cloud Directory
End User API
Admin User API Lambda Function
Lambda Function
AWS IoT
Amazon Cloud Directory
Store/Query
Relations/Metadata
modify IoT Policies
Registry

20. Do Something with the Data

21. Question:
What kind of IoT Data storage backend would you need?

22. IoT Data Architecture
AWS IoT Amazon Elasticsearch Service
Data/Search/Analytics
Amazon DynamoDB
(raw) Sensor Data
AWS Lambda
Function
Amazon
Kinesis Analytics
Amazon DynamoDB
Aggregates
Amazon
Kinesis Firehose
Amazon S3
Raw Data in flat Files
Amazon EMR Amazon S3
Processed Data per
User/Device
Amazon Athena Amazon QuickSight
End User API

23. Now Think What Queries on
Things, Relations and Data you need.
And Build Your IoT Platform

24. Thank you!