There are many different components of AWS IoT Core, including Device gateway, Registry, Message broker, Rules engine, and Device shadow. In this session, we cover each component in depth, how to use them, and best practices. Come away with an understanding of how AWS IoT Core can help you securely connect and manage devices, process and act on device data, and read and set device state. In addition to best practices, we discuss common customer questions when using different features of AWS IoT Core.

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Best Practices for AWS IoT Core
Max Jindal
Sr. Software Development Engineer
AWS IoT Core
I O T 3 4 7 - R
Alexandra Lee
Sr. Software Development Engineer
AWS IoT Core

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Related Sessions
Tuesday, November 27th
The Essentials of AWS IoT Device Management
2:30 – 3:30 | Mirage, St. Croix A
Thursday, November 29th
Anatomy of a Successful IoT Project
4:00 – 5:00 | Mirage, Grand Ballroom F

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Best Practices Summary
Connectivity and Security
1. Ensure the device clock stays
up-to-date
2. Use a single identity per
device
3. Apply fine-grained access
controls
4. Use Just-in-Time
Provisioning
Messaging
5. Do not share shadow
6. Use wildcard subscriptions
7. Place wildcard towards right
of high cardinality topic part
8. Use Rules Engine instead of
device subscriptions
9. Shard subscribers for faster
message delivery

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
1. Ensure the Device Clock Stays Up-To-Date

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
1. Ensure the Device Clock Stays Up-To-Date
✓

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Transport Layer Security (TLS) Authentication

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Device Certificates
✓
✕

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
2. Use a Single Identity per Device

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
3. Apply Fine-Grained Access Controls

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
4. Use Just In-Time Provisioning
aws iot register-ca-certificate
--ca-certificate <your-ca-cert>
--verification-cert <your-verification-cert>
--set-as-active --allow-auto-registration
--registration-config file://<your-template>

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
4. Use Just In-Time Provisioning
{ "templateBody":"{
"Parameters" : {
"AWS::IoT::Certificate::Id" : { "Type" : "String" } },
"Resources" : {
"certificate" : { "Type" : "AWS::IoT::Certificate",
"Properties" : {
"CertificateSigningRequest": {"Ref" : "CSR"},
"Status" : "ACTIVE" },
"OverrideSettings" : {
"Status" : "DO_NOTHING" }
},
"policy" : { "Type" : "AWS::IoT::Policy",
"Properties" : {
"PolicyDocument" : "{ "Version": "2012-10-17", "Statement": [{
"Effect": "Allow", "Action":["iot:Publish"], "Resource": ["arn:aws:iot:us-
east-1:123456789012:topic/foo/bar"] }] }"
}
}
}
}

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
4. Use Just In-Time Provisioning
{ "templateBody":"{
"Parameters" : {
"AWS::IoT::Certificate::Id" : { "Type" : "String" } },
"Resources" : {
"certificate" : { "Type" : "AWS::IoT::Certificate",
"Properties" : {
"CertificateSigningRequest": {"Ref" : "CSR"},
"Status" : "ACTIVE" },
"OverrideSettings" : {
"Status" : "DO_NOTHING" }
},
"policy" : { "Type" : "AWS::IoT::Policy",
"Properties" : {
"PolicyDocument" : "{ "Version": "2012-10-17", "Statement": [{
"Effect": "Allow", "Action":["iot:Publish"], "Resource": ["arn:aws:iot:us-
east-1:123456789012:topic/foo/bar"] }] }"
}
}
}
}

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
4. Use Just In-Time Provisioning
{ "templateBody":"{
"Parameters" : {
"AWS::IoT::Certificate::Id" : { "Type" : "String" } },
"Resources" : {
"certificate" : { "Type" : "AWS::IoT::Certificate",
"Properties" : {
"CertificateSigningRequest": {"Ref" : "CSR"},
"Status" : "ACTIVE" },
"OverrideSettings" : {
"Status" : "DO_NOTHING" }
},
"policy" : { "Type" : "AWS::IoT::Policy",
"Properties" : {
"PolicyDocument" : "{ "Version": "2012-10-17", "Statement": [{
"Effect": "Allow", "Action":["iot:Publish"], "Resource": ["arn:aws:iot:us-
east-1:123456789012:topic/foo/bar"] }] }"
}
}
}
}

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Messaging Patterns
Command & Control
Telemetry
Large Scale Notifications

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Command & Control - AWS IoT Shadows
SUBSCRIBE
Change Channel Forwards Command

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
5. Do Not Share Shadows

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Command & Control
Change Channel Forward Command
PUBLISH
command/switchOn
command/switchOff
command/volumeUp
command/volumeDown
…
…
SUBSCRIBE
command/switchOn
command/switchOff
command/volumeUp
command/volumeDown
…
…

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
6. Use Wildcard Subscriptions
SUBSCRIBE
command/switchOn
command/switchOff
command/volumeUp
command/volumeDown
…
…
SUBSCRIBE
command/+

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Command & Control – Multiple Devices
Change Channel
Forward Command
PUBLISH
deviced1/command/switchOn
deviced1/command/switchOff
deviced1/command/volumeUp
deviced1/command/volumeDown
…
…
SUBSCRIBE
device1/command/+
SUBSCRIBE
device2/command/+

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
7. Wildcard Placement on Subscription Topic Filter
Subscription Topic Filter should have high cardinality key before the
wildcard
scalable
scalable
deviceId/command/+
command/deviceId/+
NOT
scalable
command/+/deviceId

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Telemetry – Use Rules Engine
Amazon
Kinesis
AWS IoT rule
action
Telemetry data

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
8. Do Not Use Device Subscription for Telemetry
Telemetry data

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Large Scale Notifications
SUBSCRIBE
notification/firetv
PUBLISH
notification/firetv

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IoT fanout
For each inbound message onto AWS IoT, AWS IoT will deliver that message
to all subscribers at a rate of 10,000 per sec
For 1 million devices, it takes
100 seconds
If we wanted to deliver messages < 60 sec ?

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
9. Shard Subscribers
SUBSCRIBE
notification/firetv/shard2
SUBSCRIBE
notification/firetv/shard1
PUBLISH
notification/firetv/shard1
notification/firetv/shard2

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Best Practices Summary
Connectivity and Security
1. Ensure the device clock stays
up-to-date
2. Use a single identity per
device
3. Apply fine-grained access
controls
4. Use Just-in-Time
Provisioning
Messaging
5. Do not share shadow
6. Use wildcard subscriptions
7. Place wildcard towards right
of high cardinality topic part
8. Use Rules Engine instead of
device subscriptions
9. Shard subscribers for faster
message delivery

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.