AWS iot-sitewise documentation change
Summary
Added security recommendations for S3 bucket configuration and detailed policy explanations
Security assessment
Added guidance about using dedicated S3 buckets and IAM role requirements, enhancing security documentation
Diff
diff --git a/iot-sitewise/latest/userguide/destinations-buffered.md b/iot-sitewise/latest/userguide/destinations-buffered.md index 5c984bc1b..94a2b3b24 100644 --- a/iot-sitewise/latest/userguide/destinations-buffered.md +++ b/iot-sitewise/latest/userguide/destinations-buffered.md @@ -173 +173 @@ Type of destination. Options include: `SITEWISE_REALTIME` and `SITEWISE_BUFFERED - * `SITEWISE_REALTIME` – Send data directly to AWS IoT SiteWise storage in real-time. For more information, see [Add an AWS IoT SiteWise Edge real-time destination](./destinations-real-time.html). + * `SITEWISE_REALTIME` (default) – Send data directly to AWS IoT SiteWise storage in real-time. For more information, see [Add an AWS IoT SiteWise Edge real-time destination](./destinations-real-time.html). @@ -205 +205,5 @@ Required: Yes -The bucket ARN to publish to. +The bucket ARN to publish to. Choose the same AWS Region for both AWS IoT SiteWise and Amazon S3. If a prefix is chosen, it must have between 1-255 characters. + +###### Note + +AWS IoT SiteWise, including the gateway, will have access to the entire specified S3 bucket. We recommend using a dedicated bucket for buffered data ingestion. @@ -213,0 +218,2 @@ Required: Yes +Details of the publishing policy. + @@ -221 +227 @@ Required: Yes -The frequency with which the SiteWise Edge gateway publishes to the Amazon S3 bucket. +The frequency with which the SiteWise Edge gateway publishes to the Amazon S3 bucket. Data upload frequency to Amazon S3 must be greater than 0 minutes and less than or equal to 30 days. You can use `m`, `h`, and `d` when you specify a publishing frequency age. Note that `m` represents minutes, `h` represents hours, and `d` represents days. The default value is 15 minutes. @@ -230 +236 @@ Required: Yes -The maximum size of the files written to local disk. If this threshold is breached, the publisher publishes all buffered data to its destination. +The maximum size of the files written to local disk in GB. If this threshold is breached, the publisher publishes all buffered data to its destination. @@ -238,0 +245,2 @@ Required: Yes +Details of the import policy for importing data to AWS IoT SiteWise. + @@ -246 +254 @@ Required: Yes -Set this to `true` to import data from an Amazon S3 bucket to AWS IoT SiteWise storage. +Set this to `true` to import data from an Amazon S3 bucket to AWS IoT SiteWise storage. It initially makes a copy of the data in AWS IoT SiteWise. Then, if you set `enableDeleteAfterImport` to true, the data in S3 deletes after copying to AWS IoT SiteWise. Pricing implications apply. The default value is `true`. @@ -255 +263 @@ Required: Yes -Set this to `true` to delete the file in the Amazon S3 bucket after ingestion into the AWS IoT SiteWise storage. +Set this to `true` to delete the file in the Amazon S3 bucket after ingestion into the AWS IoT SiteWise storage. The default value is `true`. @@ -264 +272,5 @@ Required: Yes -The ARN of the IAM role that AWS IoT SiteWise assumes to read buffered data from Amazon S3 during data ingestion. This role is used when an edge device calls on AWS IoT SiteWise APIs to initiate the bulk import process. If `enableSiteWiseStorageImport` is set to `true`, this parameter is required. +The ARN of the IAM role that AWS IoT SiteWise assumes to read buffered data from Amazon S3 during data ingestion. This role is used when an edge device calls on AWS IoT SiteWise APIs to initiate the bulk import process. + +###### Note + +If `enableSiteWiseStorageImport` is set to `true`, this parameter is required.