AWS IoT is a managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices. In this webinar, we will discuss how constrained devices can leverage AWS IoT to send data to the cloud and receive commands back to the device from the cloud using protocol of their choice. We will discuss how devices can securely connect using MQTT and HTTP protocols, and how developers and businesses can leverage features of AWS IoT like Thing Shadows and Rules Engine to build a real connected product.

1. © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Kyle Roche, General Manager AWS IoT
28-Oct-2015
AWS IoT
Getting Started

2. Introduction AWS IoT

3. Things are Becoming Connected
Now
Not too long
from now Soon After
Source: Pretty much everyone

4. AWS IoT
- Fully Managed Service
- Bi-Directional / Long Lived Connections
- Security and Identity Schemes Built for Devices
- Bridge to other AWS Services

5. AWS IoT - Console Interactive Tutorial

6. AWS IoT
DEVICE SDK
Set of client libraries to
connect, authenticate and
exchange messages
DEVICE GATEWAY
Communicate with devices via
MQTT and HTTP
AUTHENTICATION
AUTHORIZATION
Secure with mutual
authentication and encryption
RULES ENGINE
Transform messages
based on rules and
route to AWS Services
AWS Services
- - - - -
3P Services
DEVICE SHADOW
Persistent thing state
during intermittent
connections
APPLICATIONS
AWS IoT API
DEVICE REGISTRY
Identity and Management of
your things

7. AWS IoT Device Registry

8. AWS IoT Device Registry
THING REGISTRY
Identity and Management of
your things
REGISTRY
Identity and Management of
your things

9. AWS IoT Device Registry
Device Metadata
- Serial #
- EIN / IMEI
- ASIN
- Support URLa

10. AWS IoT Device Registry (CLI)
kyleroche@Kyles-MacBook-Pro: aws iot list-things
{
"things": [
{
"attributes": {
"ASIN": "B006LPJZ1S",
"EIN": "SDLKFJ23423KJOIJOJL",
"serial_number": "K123Y34R456O"
},
"thingName": "thing01"
}
]
}

11. Security & Identity

12. AWS IoT Security
AUTHENTICATION
Secure with mutual
authentication and encryption
AUTHENTICATION
AUTHORIZATION
Secure with mutual
authentication and encryption

13. Securing and Identifying Things
- Secure Bi-Directional Pipe
- Anonymous

14. Securing and Identifying Things
- Secure Bi-Directional Pipe
- Anonymous
- Secure Bi-Directional Pipe
- Anonymous

15. Securing and Identifying Things: Mutual Auth TLS
- Secure Bi-Directional Pipe
- Anonymous
- Secure Bi-Directional Pipe
- Mutual Proof of Identity

16. Security, Designed for Connected Devices
MQTT + Mutual Auth TLS AWS Auth + HTTPS
Server Auth TLS + Cert TLS + Cert
Client Auth TLS + Cert AWS API Keys
Confidentiality TLS TLS
Protocol MQTT HTTP
Identification AWS ARNs AWS ARNs
Authorization AWS Policy AWS Policy
NEW

17. Rule Invocations - IAM Roles
- Service iot.amazonaws.com
- Assumes Role
- Policy Allows Actions to other services

18. Demo
Create Keys & Certificate

19. Demo Steps
- Create Keys & Certificate
- Create Thing in Registry (optional)
- Create Policy Document
- Attach Policy to Certificate and Thing

20. AWS IoT Device Gateway

21. AWS IoT Device Gateway
DEVICE GATEWAY
Communicate with devices via
MQTT and HTTP

22. AWS IoT Device Gateway
Standard Protocol Support (no lock-in)
Millions of devices and apps can connect
over any protocol starting with MQTT and
HTTP 1.1
Powerful Pub/Sub Broker with Long-
lived bi-directional messages
Clients (Devices and Apps) can receive
commands and control signals from the
cloud
Secure by Default
Connect securely via X509 Certs and TLS
1.2 Client Mutual Auth
Topic Based
Architecture
(lights/thing-2/color)
Highly Scalable
Device Gateway

23. Demo
Publish and Subscribe (MQTT)

24. AWS IoT Rules Engine

25. AWS IoT Rules Engine
RULES ENGINE
Transform messages
based on rules and
route to AWS Services

26. AWS IoT Rules Engine Basics
SELECT * FROM ‘things/thing-2/color’
WHERE color = ‘red’
Rule
Name
Description
SQL Statement
Array of Actions

27. Simple & Familiar Syntax
- SQL Statement to define topic filter
- Optional WHERE clause
- Advanced JSON support
Functions improve signal : noise
- String manipulation (regex support)
- Mathematical operations
- Context based helper functions
- Crypto support
- UUID, Timestamp, rand, etc.
AWS IoT Rules Engine Basics
SELECT * FROM ‘things/thing-2/color’
WHERE color = ‘red’

28. AWS IoT - SQL Reference
SELECT DATA FROM TOPIC WHERE FILTER

29. AWS IoT - SQL Reference
SELECT DATA FROM TOPIC WHERE FILTER
• Like scanning a database table
• Default source is an MQTT topic
EXAMPLES:
• FROM mqtt(‘my/topic’)
• FROM mqtt(‘my/wildcard/+/topic’)
• FROM (‘my/topic’)

30. AWS IoT - SQL Reference
SELECT DATA FROM TOPIC WHERE FILTER
• Properties from the JSON Object in the payload
• “.” Operator
• “..” Operator
• “*” Operator
• Apply functions to attribute value

31. AWS IoT - SQL Reference
SELECT DATA FROM…
• SELECT deviceid AS client
• SELECT md5(deviceid) AS hashed_id
Substitution Templates
• ${expression}
• ${topic() - md5(deviceid)}
• ${deviceid - temp}
{
“deviceid” : “iot123”,
“temp” : 54,
“humidity” : 32,
“coords” : {
“latitude” : 47.615694,
“longitude” : -122.3359976
},
“a” : {
“another_level” : {
{“b” : 3},
{“b” : 5}
}}
}
SAMPLE PAYLOAD

32. AWS IoT Rules Engine Actions
RULES ENGINE
Transform messages
based on rules and
route to AWS Services
AWS Services
- - - - -
3P Services
AWS Services
- - - - -
3P Services

33. AWS IoT Rules Engine Actions
Rules Engine evaluates inbound
messages published into AWS
IoT, transforms and delivers to the
appropriate endpoint based on
business rules.
External endpoints can be
reached via Lambda and Simple
Notification Service (SNS).
Invoke a Lambda function
Put object in an S3 bucket
Insert, Update, Read from a
DynamoDB table
Publish to an SNS Topic
or Endpoint
Publish to a Kinesis stream
Actions
Amazon Firehose
Republish to AWS IoT

34. Rule Template - Invoke Lambda
kyleroche@Kyles-MacBook-Pro: aws iot get-topic-rule --rule-name invokeLambda
{
"rule": {
"sql": "SELECT * FROM 'things/rules/lambda'",
"ruleDisabled": false,
"actions": [
{
"lambda": {
"functionArn": "arn:aws:lambda:us-east-1:8675309:function:helloWorld"
}
}
],
"ruleName": "invokeLambda"
}
}

35. Invoke Lambda function from MQTT
kyleroche@Kyles-MacBook-Pro: mosquitto_pub --cafile rootCert.pem --cert cert.pem --key
privateKey.pem -h A3OZCB0FJ4Y4JS.iot.us-east-1.amazonaws.com -p 8883 -q 1 -d -t
things/rules/lambda -i thing01 -m ”{"color":"red"}”
MQTT Payload available to
Lambda event parameter

36. AWS IoT Rules Engine & Stream Data
N:1 Inbound Streams of Sensor Data (Signal to Noise Reduction)
Rules Engine filters, transforms sensor data then sends aggregate to Amazon Kinesis
Kinesis Streams to Enterprise Applications
Simultaneously stream processed data to databases, applications, other AWS
Services
Ordered Stream

37. AWS IoT Rules Engine for Machine Learning
Anomaly Detection
Amazon Machine Learning can feed predictive evaluation criteria to the Rules Engine
Continuous Improvement around Predication
Continuously look for outliers and re-calibrate the Machine Learning models
Send to S3
Amazon
Machine
Learning
Re-Train

38. AWS IoT – Device Management
S3 Holds Versioned Firmware Distributions
Organize and secure your firmware binaries in S3
Message Broker notifies groups of the fleet using Topic Patterns
Alert the fleet (or part of it) of the update, and send the URL to the S3 download
Firmware Update
Stored in S3
Publish to groups of devices
• Ability to update global
or within a Region
• Rules Engine keeps
state of updates and
tracks progress in a
DynamoDB Table
• Store Version in
Registry Entry

39. Rule Template - Save to DynamoDB
kyleroche@Kyles-MacBook-Pro: aws iot get-topic-rule --rule-name saveToDynamoDB
{
"rule": {
"sql": "SELECT * FROM 'things/rules/dynamo'",
"ruleDisabled": false,
"actions": [
{
"dynamoDB": {
"hashKeyField": "topic",
"roleArn": "arn:aws:iam::8675309:role/iot-actions-role",
"tableName": "awsiot",
"hashKeyValue": "${topic(3)}",
"rangeKeyValue": "${timestamp()}",
"rangeKeyField": "timestamp"
}
}
],
"ruleName": "saveToDynamoDB"
}
}

40. Demo
Rules - Save to DynamoDB

41. AWS IoT Device Shadow

42. AWS IoT Device Shadow
THING SHADOW
Persistent thing state
during intermittent
connections
SHADOW
Persistent thing state
during intermittent
connections
APPLICATIONS

43. AWS IoT Shadow Flow
Device SDK
1. Device Publishes Current State
2. Persist JSON Data Store
3. App requests device’s current state
4. App requests change the state
5. Device Shadow sync’s
updated state
6. Device Publishes Current State
7. Device Shadow confirms state change

44. AWS IoT Device Shadow Topics (MQTT)
Thing SDK (C-SDK, JS-SDK)
makes it easy for you build shadow
functionality into your device so it
can automatically synchronize the
state with the device.
AWS IoT Thing Shadow
UPDATE: $aws/things/{thingName}/shadow/update
DELTA: $aws/things/{thingName}/shadow/update/delta
GET: $aws/things/{thingName}/shadow/get
DELETE: $aws/things/{thingName}/shadow/delete
Sensor Reported Desired Delta
LED1 RED YELLOW
LED1 =
Yellow
TEMP = 60F
ACCEL X=1,Y=5,Z=4 X=1,Y=5,Z=4
TEMP 83F 60F

45. Demo
AWS IoT Device Shadow

46. Pricing

47. Pay as You Go
- No minimum
- $5 per million messages published to, or delivered in
US East (N. Virginia), US West (Oregon), EU (Ireland)
- $8 per million in Asia Pacific (Tokyo)
- No fees for Rules, Shadows, Deliveries to other AWS
Services
Free Tier
250,000 Messages Per Month Free for first 12
Months

48. Hardware and SDKs

49. Get Started with AWS IoT Device SDK
C-SDK
(Ideal for embedded
OS)
JS-SDK
(Ideal for Embedded
Linux Platforms)
Arduino Library
(Arduino Yun)
Mobile SDK
(Android and iOS)

50. Official IoT Starter Kits, Powered by AWS

51. Summary
- Components of AWS IoT
- Securely Identify and Connect a Device
- Device Gateway
- Publish and Subscribe over MQTT
- Rules and Actions
- Device Shadows
- SDKs and Starter Kits

52. Thank you!
https://aws.amazon.com/iot
@kylemroche