AWS iot-sitewise medium security documentation change
Summary
Simplified EMQX broker ACL configuration by replacing manual file editing with CLI commands. Removed detailed Docker network inspection steps and added automated ACL initialization using '/greengrass/v2/bin/swe-emqx-cli' tool.
Security assessment
The change replaces error-prone manual ACL configuration with an automated tool, reducing risks of misconfiguration that could leave the broker exposed. By programmatically enforcing IP-based access rules, it addresses potential security weaknesses from manual editing mistakes. The documentation now explicitly states the tool 'automatically creates and applies authorization rules', indicating security-focused access control implementation.
Diff
diff --git a/iot-sitewise/latest/userguide/add-auth-rules-database-emqx-broker-linux.md b/iot-sitewise/latest/userguide/add-auth-rules-database-emqx-broker-linux.md index 930e65647..bfcaa3a84 100644 --- a//iot-sitewise/latest/userguide/add-auth-rules-database-emqx-broker-linux.md +++ b//iot-sitewise/latest/userguide/add-auth-rules-database-emqx-broker-linux.md @@ -26 +26 @@ If you initially configure the Docker bridge gateway and later install Litmus Ed - 3. Determine the Docker bridge network gateway or Litmus Edge network subnet IP address by running one of the following Docker commands: +Docker without Litmus Edge @@ -28 +27,0 @@ If you initially configure the Docker bridge gateway and later install Litmus Ed -Docker bridge gateway @@ -29,0 +29 @@ Docker bridge gateway +For standard Docker installation without Litmus Edge, run: @@ -31,16 +31 @@ Docker bridge gateway - docker network inspect bridge | grep IPAM -A9 - -Review the output, which resembles the following: - - "IPAM": { - "Driver": "default", - "Options": null, - "Config": [ - { - "Subnet": "172.17.0.0/16", - "Gateway": "172.17.0.1" - } - ] - }, - -Note the Gateway value. By default, it is `172.17.0.1` unless you have a custom Docker setup. + /greengrass/v2/bin/swe-emqx-cli acl init @@ -51 +36 @@ Litmus Edge network subnet -If you have Litmus Edge deployed, run this command instead: +If you're using Litmus Edge, determine the Litmus Edge network subnet IP: @@ -55,12 +40 @@ If you have Litmus Edge deployed, run this command instead: -Note the Subnet value. - - 4. Create an Access Control List (ACL) file on the EMQX broker container by running the following command: - - docker exec emqx mkdir /opt/emqx/data/authz/ && docker exec -it emqx vi /opt/emqx/data/authz/acl.conf - - 5. Press the "i" key to enter edit mode. - - 6. Paste the following content: - -Docker bridge gateway - +Note the Subnet value from the output and run the following command. Replace `litmus_subnet_ip` with the Subnet value from the previous step. @@ -68,70 +42 @@ Docker bridge gateway -Replace `docker_bridge_gateway` with the Gateway value from the previous step. - - %%-------------------------------------------------------------------- - %% -type(ipaddr() :: {ipaddr, string()}). - %% - %% -type(ipaddrs() :: {ipaddrs, string()}). - %% - %% -type(username() :: {user | username, string()} | {user | username, {re, regex()}}). - %% - %% -type(clientid() :: {client | clientid, string()} | {client | clientid, {re, regex()}}). - %% - %% -type(who() :: ipaddr() | ipaddrs() |username() | clientid() | - %% {'and', [ipaddr() | ipaddrs()| username() | clientid()]} | - %% {'or', [ipaddr() | ipaddrs()| username() | clientid()]} | - %% all). - %% - %% -type(action() :: subscribe | publish | all). - %% - %% -type(topic_filters() :: string()). - %% - %% -type(topics() :: [topic_filters() | {eq, topic_filters()}]). - %% - %% -type(permission() :: allow | deny). - %% - %% -type(rule() :: {permission(), who(), access(), topics()} | {permission(), all}). - %%-------------------------------------------------------------------- - - {allow, {ipaddr, "docker_bridge_gateway"}, all, ["$SYS/#", "#"]}. - - {deny, all}. - -Litmus Edge network subnet - - -Replace `litmus_network_subnet` with the Subnet value from previous step. - - %%-------------------------------------------------------------------- - %% -type(ipaddr() :: {ipaddr, string()}). - %% - %% -type(ipaddrs() :: {ipaddrs, string()}). - %% - %% -type(username() :: {user | username, string()} | {user | username, {re, regex()}}). - %% - %% -type(clientid() :: {client | clientid, string()} | {client | clientid, {re, regex()}}). - %% - %% -type(who() :: ipaddr() | ipaddrs() |username() | clientid() | - %% {'and', [ipaddr() | ipaddrs()| username() | clientid()]} | - %% {'or', [ipaddr() | ipaddrs()| username() | clientid()]} | - %% all). - %% - %% -type(action() :: subscribe | publish | all). - %% - %% -type(topic_filters() :: string()). - %% - %% -type(topics() :: [topic_filters() | {eq, topic_filters()}]). - %% - %% -type(permission() :: allow | deny). - %% - %% -type(rule() :: {permission(), who(), access(), topics()} | {permission(), all}). - %%-------------------------------------------------------------------- - - {allow, {ipaddr, "litmus_network_subnet"}, all, ["$SYS/#", "#"]}. - - {deny, all}. - -This policy allows all connections from within the gateway host to connect to the broker, publish, and subscribe to all topics. This includes the IoT SiteWise OPC UA collector and IoT SiteWise publisher. - - 7. Type ":wq" and then press `Enter` to save and exit the file editor. - -###### Note + /greengrass/v2/bin/swe-emqx-cli acl init litmus_subnet_ip @@ -139 +44 @@ This policy allows all connections from within the gateway host to connect to th -At this point, the rules are written to the file but not yet applied. +The tool automatically creates and applies authorization rules to allow connections from the provided IP address to the broker. It allows access to all topics. This includes the IoT SiteWise OPC UA collector and IoT SiteWise publisher. @@ -141 +46 @@ At this point, the rules are written to the file but not yet applied. - 8. Proceed to [Update the EMQX deployment configuration for authorization](./update-emqx-broker-authorization.html). + 3. Proceed to [Update the EMQX deployment configuration for authorization](./update-emqx-broker-authorization.html).