AWS iot medium security documentation change

Service: iot · 2025-04-11 · Security-related medium

File: iot/latest/developerguide/provision-template.md

Summary

Added ThingPrincipalType parameter to enforce exclusive certificate-thing relationships and updated provisioning guidance.

Security assessment

Introduces EXCLUSIVE_THING option to prevent certificate sharing between devices, directly addressing potential security risks from shared credentials.

Diff

diff --git a/iot/latest/developerguide/provision-template.md b/iot/latest/developerguide/provision-template.md
index be2586bc1..d65c39d84 100644
--- a//iot/latest/developerguide/provision-template.md
+++ b//iot/latest/developerguide/provision-template.md
@@ -119,0 +120,10 @@ Certificate resources are declared using the following properties:
+  * `ThingPrincipalType`: Optional. String that specifies the type of relationship between the thing and the principal (the certificate).
+
+    * `EXCLUSIVE_THING`: Establishes an exclusive relationship. The principal can only be attached to this specific Thing and no others.
+
+    * `NON_EXCLUSIVE_THING`: Attaches the specified principal to things. You can attach multiple Things to the principal. This is the default value if not specified.
+
+###### Note
+
+You can also provision devices without device certificates. For more information, see [Provisioning devices that don't have device certificates using fleet provisioning](./provision-wo-cert.html).
+
@@ -160,0 +171,12 @@ Examples:
+  * Exclusively attach one thing to a principal:
+    
+        {
+        "certificate" : {
+            "Type" : "AWS::IoT::Certificate",
+            "Properties" : {
+                "ThingPrincipalType" : "EXCLUSIVE_THING"
+            }
+        }
+    }
+    
+
@@ -331 +353,2 @@ The following JSON file is an example of a complete provisioning template that s
-                    "Status" : "ACTIVE"      
+                    "Status" : "ACTIVE",
+                    "ThingPrincipalType" : "EXCLUSIVE_THING"
@@ -396 +419,2 @@ The following JSON file is an example of a complete provisioning template that s
-                "Status":"ACTIVE"
+                "Status":"ACTIVE",
+                "ThingPrincipalType" : "EXCLUSIVE_THING"
@@ -523 +547,2 @@ Substitutes variables in an input string with values that you specify. You can u
-                    "Status" : "Active"
+                    "Status" : "Active",
+                    "ThingPrincipalType" : "EXCLUSIVE_THING"
@@ -557 +582 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Bulk registration
+Provisioning devices that don't have device certificates using fleet provisioning