This session covers the deployment and operation of AWS IoT-managed devices in industrial settings. We provide an overview of how industrial facilities are managed via operational technology and discuss the benefits of using IoT devices to augment industrial control systems—either through overlay capabilities or through direct integration with existing control systems or historians. We discuss the different methods of secure IoT device deployments without compromising health, safety, or security. Finally, we cover integration of IoT devices from an IT perspective, how devices can operate in harsh operating environments, and considerations for open standards to help ensure compliance.

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Deploying AWS IoT–managed devices
in an industrial setting
Gavin Adams
Sr. IoT specialist solutions architect
Amazon Web Services
S V C 3 0 2

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Agenda
Operational technology (OT), IT, and cloud technology
Benefits of AWS Internet of Things (IoT)
Key blockers for deploying IoT devices
Deployment architectures

3. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Operations, enterprise, cloud
Operations (OT) Enterprise (IT)
IT systems
Customer relationship management
Asset management
Enterprise resource planning (ERP)
Supply chain
Finance
Maintenance
Compliance
Supervisory Control
and Data Acquisition
(SCADA),
data control system
(DCS), etc.
Various protocols
Cloud
Amazon Kinesis Amazon QuickSight
AWS IoT Core Amazon SageMaker

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
ISA-95 in the context of the AWS Cloud
Level 1
Line/machine
control
Animation
direct control
Level 3
Level 4
Description
Manufacturing
operations
management
Business
planning and
logistics
MES/
historian
ERP/PLP/
SCM
App/systemFunction
Line/cell execution
Business
operations
DCS/PLC/
RTU
Level 0
Physical
values
Raw data-
event signals
I/O sensor
AWS
architecture
Enterprise
apps in the
cloud
AWS IoT SiteWise
Level 2
Line/machine
supervision
SCADA/
HMI
Supervisory
control
AWS IoT
Greengrass
AWS IoT–
aware device
AWS IoT–
aware device

6. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Commonly heard use cases for IIoT
• Predictive maintenance
• Digital or connected factory
• Improved facilities management
• Plant and human-health safety
• Gain new insights into existing process systems
• Improve, increase, decrease, make more efficient … “stuff”

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Predictive maintenance
PLC/SCADA/DCS
Vibration
Acoustic
Amazon SageMaker
AWS IoT Core
Tag values
Extended values
Maintenance
predictions
Objectives
How

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Workplace safety
Objectives
How

10. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Blockers to implementation
• Security/safety
• Type-1 hazards
• Intrinsic safety, explosion-proof
• Proprietary information
• Networking/security
• Encryption in transit and at rest
• Process network to business network to cloud
• Ports, protocols, persistence
• Detective security
• Resilience/reliability
• Singular devices
• Online and offline connectivity

12. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
“It’s leaving here just fine. The problem
must be on your end.”
Anonymous telecommunications engineer
circa 1995

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Finding IT and OT common ground
• Mission and objectives
• Address concerns
• IT
• Greater scope of impact
• Physical risks and safety
• Legacy plant systems (Windows NT 4.0)
• OT
• Physical risks and safety
• Data leaks
• IT and OT working together

14. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
PLC/SCADA/DCS
Amazon FreeRTOS
Device
AWS IoT Device Defender
AWS IoT Greengrass Core
AWS IoT Core
AWS IoT SiteWise
Industrial system(s)
Temperature
IoT camera
MQTT
device
gateway
Humidity
Vibration
AWS IoT SiteWise
on AWS IoT Greengrass Core
AWS CloudProcess network (OT) Business network (IT)

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS IoT Device Defender
AWS IoT Core
AWS IoT SiteWise
Temperature
MQTT
device
gateway
Humidity
Vibration
AWS Cloud
Process network (OT) Business network (IT)
Using port
TCP/8883
Establish TLS 1.2 connection
To public FQDN
MQTT connection to AWS IoT Core
IT questions
1. Where is this device connecting to?
2. How does it create a connection?
3. What protocol/port is used?

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS IoT Device Defender
AWS IoT Core
AWS IoT SiteWise
Temperature
MQTT
device
gateway
Humidity
Vibration
AWS Cloud
Process network (OT) Business network (IT)
Using port
TCP/8883
Establish TLS 1.2 connection
To public FQDN
MQTT connection to AWS IoT Core

18. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
“Can’t get there from here”
R.E.M.
Fables of the Reconstruction, 1985

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Here
There
Just poke a hole for…

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The details: TCP protocols and ports
At launch Current
AWS IoT Core
MQTT – 8883
MQTT over WebSocket – 443
HTTP – 8443 or 443
MQTT* – 8883 or 443
MQTT over WebSocket – 443
HTTP* - 8443 or 443
AWS IoT
Greengrass
MQTT – 8883
HTTP – 8443
AWS services - 443
MQTT – 8883 or 443
HTTP – 8443 or 443
AWS services - 443
X.509 client certificate
SigV4
* TLS ALPN ProtocolName

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS IoT Core
MQTT
device
AWS Cloud
The details: Public endpoint
XXXX-ats.iot.REGION.amazonaws.com
Server certificate: *.iot.REGION.amazonaws.com
issued by Amazon Trust Services CA1 / CA3
Root CA
store
Resolves to:
1.1.1.1
2.2.2.2
3.3.3.3
or
2.2.2.2
4.4.4.4
9.9.9.9
IP ranges:
https://docs.aws.amazon.com
/general/latest/gr/aws-ip-
ranges.html
Methods to implement
• Whitelist all public AWS IP addresses for region
• AWS Direct Connect public VIF
• Intelligent firewall to cache FQDN resolution
• Network proxy server
• Reverse proxy into Amazon Virtual Private Cloud
(Amazon VPC)

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS IoT Device Defender
AWS IoT Core
AWS IoT SiteWise
Temperature
MQTT
device
gateway
Humidity
Vibration
AWS Cloud
Process network (OT) Business network (IT)
Using port
TCP/443
Establish TLS 1.2 connection
to AWS Io T endpoint
To public FQDN
MQTT connection – Proxy
Network
proxy
(tunnel)
Inspects TLS and FQDN
values

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS IoT Core
AWS IoT SiteWise
Temperature
MQTT
device
gateway
Humidity
Vibration
AWS Cloud
Process network (OT) Business network (IT)
Using port
TCP/443
Establish TLS 1.2 connection
to AWS Io T endpoint
MQTT connection – Reverse proxy
Network
proxy
(tunnel)
Inspects TLS and FQDN
values
Amazon VPC
Reverse proxyNetwork
load
balancer

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
MQTT connection to AWS IoT Core summary
• Detailed Transport Layer Security (TLS) and protocol specifics
• Select method for connecting to endpoints
• Direct
• Network proxy
• Reverse proxy
• Ensure keepalive values consistent from device to AWS IoT Core endpoint
• Verify operation over time (e.g., test timeouts, endpoint IP address, etc.)
• Document and use same method for other devices

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon FreeRTOS
device
AWS IoT Greengrass Core AWS IoT Core
IoT camera
AWS Cloud
Process network (OT)
AWS IoT Greengrass
Business network (IT)
AWS IoT Greengrass – Connections
Amazon Simple Storage
Service (Amazon S3)
Amazon CloudWatch
(logs)

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon FreeRTOS
device
AWS IoT Greengrass Core AWS IoT Core
IoT camera
AWS Cloud
Process network (OT)
AWS IoT Greengrass
Business network (IT)
AWS IoT Greengrass – Endpoints
MQTT 443/8883
XXX-ats.iot…
HTTP 443/8443
greengrass-ats.iot…
HTTP 443
*.s3…
HTTP 443
logs…
MQTT 8883
IP address or hostname
Northern Virginia example
• AWS IoT Core –
• AWS IoT Greengrass –
• Amazon S3 –
• Amazon CloudWatch logs –
Other AWS service endpoints
Amazon S3
Amazon CloudWatch
(logs)

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon FreeRTOS
device
AWS IoT Greengrass Core AWS IoT Core
IoT camera
AWS Cloud
Process network (OT)
AWS IoT Greengrass
Business network (IT)
AWS IoT Greengrass – Network proxy
Network
proxy
(tunnel)
Amazon S3
Amazon CloudWatch
(logs)

28. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Setting AWS IoT Greengrass proxy and ports
/greengrass/config/config.json:
{
"coreThing" : {
"caPath" : "root.ca.pem",
"certPath" : "hash.cert.pem",
"keyPath" : "hash.private.key",
"thingArn" : "arn:aws:iot:region:account-id:thing/core-thing-name",
"iotHost" : "host-prefix-ats.iot.region.amazonaws.com",
"iotMqttPort" : 443,
"ggHost" : "greengrass-ats.iot.region.amazonaws.com",
"ggHttpPort" : 443,
"keepAlive" : 600,
"networkProxy": {
"noProxyAddresses" : "http://128.12.34.56,www.mywebsite.com",
"proxy" : {
"url" : "https://my-proxy-server:1100",
"username" : "Mary_Major",
"password" : "pass@word1357"
}
}
},
...
}

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS IoT Greengrass connections summary
• Use config.json as source of truth
• Define endpoints, ports, and keepalive values
• AWS software development kits honor network proxy settings
• AWS IoT Greengrass–aware devices require direct Internet connectivity for
discovery*
• Verify operation over time (timeouts, endpoints, AWS IoT Greengrass
connectors, Lambda functions, etc.)

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
PLC/SCADA/DCSIndustrial system(s) AWS IoT SiteWise
on AWS IoT Greengrass Core
AWS Cloud
Process network (OT) Business network (IT)
AWS IoT Core
and credentials provider
AWS IoT Analytics
AWS IoT SiteWise connectivity
AWS IoT SiteWise details
• Common use of iot, greengrass, s3, and logs endpoints
OPC-UA
client/server
AWS IoT Greengrass
AWS IoT SiteWise

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS IoT SiteWise connectivity summary
• AWS IoT Greengrass as base platform, those connection notes apply
• Uses AWS IoT Analytics as ingest method, little traffic seen on MQTT port
• Other AWS service endpoints used
• Network proxy servers can help identify new or unknown endpoints being used

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
PLC/SCADA/DCS
Amazon FreeRTOS
device
AWS IoT Device Defender
AWS IoT Greengrass Core
AWS IoT Core
AWS IoT SiteWise
Industrial system(s)
Temperature
IoT camera
MQTT
device
gateway
Humidity
Vibration
AWS IoT SiteWise
on AWS IoT Greengrass Core
AWS CloudProcess network (OT) Business network (IT)
Extend security with AWS IoT Device Defender

33. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
General takeaways
• Establish a relationship and understanding between IT and OT
• Consider safety and security as “job-zero” requirements
• Provide “400-level” details on designs for implementation
• Engage your AWS account team early on

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Technical takeaways
• Understand security models used by AWS IoT Core and AWS IoT Greengrass
• TLS 1.2
• X.509 Client Certificate Mutual Authentication
• SigV4
• Network configurations
• Public endpoints
• Architectures to meet security policies
• Use services such as AWS IoT Device Defender to address security within the
TLS-secured connections

36. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Gavin Adams
gavinaws@amazon.com