AWS iot-device-defender documentation change
Summary
Added configurable expiration thresholds for certificate checks and example configuration
Security assessment
Enhances documentation for security monitoring features but does not indicate remediation of a security issue
Diff
diff --git a/iot-device-defender/latest/devguide/audit-chk-device-cert-approaching-expiration.md index e05aa7687..797789a9d 100644 --- a/iot-device-defender/latest/devguide/audit-chk-device-cert-approaching-expiration.md +++ b/iot-device-defender/latest/devguide/audit-chk-device-cert-approaching-expiration.md @@ -5 +5 @@ -DetailsWhy it mattersHow to fix it +DetailsWhy it mattersConfiguring the Device certificate expiring checkHow to fix it @@ -9 +9 @@ DetailsWhy it mattersHow to fix it -A device certificate is expiring within 30 days or has expired. +A device certificate is expiring within the configured threshold period or has expired. The certificate expiration check threshold can be configured between 30 days (minimum) and 3652 days (10 years, maximum) with a default value of 30 days. @@ -31,0 +32,18 @@ A device certificate should not be used after it expires. +## Configuring the Device certificate expiring check + +This configuration enables you to monitor and receive alerts for certificates that are approaching their expiration date across your device fleet. For example, if you want to be notified when certificates are within 30 days of expiration, you can configure the check as follows: + + + { + "roleArn": "your-audit-role-arn", + "auditCheckConfigurations": { + "DEVICE_CERTIFICATE_EXPIRING_CHECK": { + "enabled": true, + "configuration": { + "CERT_EXPIRATION_THRESHOLD_IN_DAYS": "30" + } + } + } + } + + @@ -63 +81 @@ Conflicting MQTT client IDs -Revoked device certificate still active +Device certificate age check