AWS iot-mi medium security documentation change
Summary
Restructured documentation with added IAM policy requirements for CreateDestination API access, clarified setup steps, added DEVICE_DISCOVERY_STATUS event type, and updated ARN formats
Security assessment
Added explicit IAM policy requiring iam:PassRole with service restriction to iotmanagedintegrations.amazonaws.com. This change enforces security controls by specifying least-privilege permissions required to configure notification destinations, preventing arbitrary role assumption. The documentation now explicitly states API calls will fail without proper permissions.
Diff
diff --git a/iot-mi/latest/devguide/managedintegrations-notifications.md b/iot-mi/latest/devguide/managedintegrations-notifications.md index 88039afc2..1c433cb34 100644 --- a//iot-mi/latest/devguide/managedintegrations-notifications.md +++ b//iot-mi/latest/devguide/managedintegrations-notifications.md @@ -5 +5 @@ -Setting up managed integrations notifications +Set up managed integrations notifications @@ -7,3 +7 @@ Setting up managed integrations notifications -Managed integrations for AWS IoT Device Management is in preview release and is subject to change. For access, contact us from the [managed integrations console](https://console.aws.amazon.com/iot/home#/managed-integrations/intro). - -# Set up managed integrations notifications +# Managed integrations notifications @@ -13,6 +11 @@ Managed integrations notifications manage all notifications to customers facilit -###### Topics - - * Setting up managed integrations notifications - - - +## Set up managed integrations notifications @@ -20 +13 @@ Managed integrations notifications manage all notifications to customers facilit -## Setting up managed integrations notifications +To setup managed integrations notifications, follow these steps: @@ -22,3 +15 @@ Managed integrations notifications manage all notifications to customers facilit -To setup an managed integrations notification, complete the following four steps. - -**Create an Amazon Kinesis data stream** + 1. **Create an Amazon Kinesis data stream** @@ -30 +21 @@ Currently, only Amazon Kinesis data streams are supported as an option for a cus -**Create an Amazon Kinesis stream access role** + 2. **Create an Amazon Kinesis stream access role** @@ -36 +27 @@ For more information, see [IAM role creation](https://docs.aws.amazon.com/IAM/la -**Call the`CreateDestination` API** + 3. **Give user permissions to call the`CreateDestination` API** @@ -38 +29 @@ For more information, see [IAM role creation](https://docs.aws.amazon.com/IAM/la -After you have created your Amazon Kinesis data stream and stream access role, call the `CreateDestination` API to create your customer-managed destination where the managed integrations notifications will be routed to. For the `deliveryDestinationArn` parameter, use the `arn` from your new Amazon Kinesis data stream. +The following policy defines the requirements for the user to call the [CreateDestination](https://docs.aws.amazon.com/iot-mi/latest/APIReference/API_CreateDestination.html) API. If not set, the call to `CreateDestination` API will fail. @@ -39,0 +31,26 @@ After you have created your Amazon Kinesis data stream and stream access role, c +See [ Grant a user permissions to pass a role to an AWS service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html.html) in the _AWS Identity and Access Management_ User Guide to get passrole permissions to managed integrations. + + { + "Version":"2012-10-17", + "Statement":[ + { + "Effect":"Allow", + "Action":"iam:PassRole", + "Resource":"arn:aws:iam::accountID:role/kinesis_stream_access_role", + "Condition":{ + "StringEquals":{ + "iam:PassedToService":"iotmanagedintegrations.amazonaws.com" + } + } + }, + { + "Effect":"Allow", + "Action":"iotmanagedintegrations:CreateDestination", + "Resource":"*" + } + ] + } + + 4. **Call the`CreateDestination` API** + +After you have created your Amazon Kinesis data stream and stream access role, call the [CreateDestination](https://docs.aws.amazon.com/iot-mi/latest/APIReference/API_CreateDestination.html) API to create your customer-managed destination where the managed integrations notifications will be routed to. For the `deliveryDestinationArn` parameter, use the `arn` from your new Amazon Kinesis data stream. @@ -46 +63 @@ After you have created your Amazon Kinesis data stream and stream access role, c - "RoleArn": "Your Role arn" + "RoleArn": "arn:aws:iam::accountID:role/kinesis_stream_access_role" @@ -49,3 +66 @@ After you have created your Amazon Kinesis data stream and stream access role, c -**Call the`CreateNotificationConfiguration` API** - -Lastly, you will create the notification configuration that will notify you of a chosen event type by routing a notification to your customer-managed destination represented by your Amazon Kinesis data stream. Call the `CreateNotificationConfiguration` API to create the notification configuration. In the `destinationName` parameter, use the same destination name as initially created when you created the customer-managed destination using the `CreateDestination` API. + 5. **Call the`CreateNotificationConfiguration` API** @@ -52,0 +68 @@ Lastly, you will create the notification configuration that will notify you of a +Lastly, you will create the notification configuration that will notify you of a chosen event type by routing a notification to your customer-managed destination represented by your Amazon Kinesis data stream. Call the [CreateNotificationConfiguration](https://docs.aws.amazon.com/iot-mi/latest/APIReference/API_CreateNotificationConfiguration.html) API to create the notification configuration. In the `destinationName` parameter, use the same destination name as initially created when you created the customer-managed destination using the `CreateDestination` API. @@ -60 +75,0 @@ Lastly, you will create the notification configuration that will notify you of a -The following lists the event types that can be monitored with managed integrations notifications: @@ -62 +77,5 @@ The following lists the event types that can be monitored with managed integrati - * States the association status of the connector. + + +### Event types monitored with managed integrations + +The following are the event types monitored with managed integrations notifications: @@ -66 +85 @@ The following lists the event types that can be monitored with managed integrati - * The status of the `SendManagedThing` API command. This valid values are either succeeded or failed. + * The status of the [SendManagedThing](https://docs.aws.amazon.com/iot-mi/latest/APIReference/API_SendManagedThing.html) API command. Valid values are either `succeeded` or `failed`. @@ -77 +96 @@ The following lists the event types that can be monitored with managed integrati - "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managedThing/6a7e8feb-b491-4cf7-a9f1-bf3703467718" + "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managed-thing/6a7e8feb-b491-4cf7-a9f1-bf3703467718" @@ -91 +110 @@ The following lists the event types that can be monitored with managed integrati -The WebRTC standard allows communication between two peers. These peers can transmit real-time video, audio, and arbitrary data. Managed integrations supports WebRTC to enable these types of streaming between a customer mobile application and an end-user's device. For more information on the WebRTC standard, see [https://webrtc.org/](https://webrtc.org/). +The WebRTC standard allows communication between two peers. These peers can transmit real-time video, audio, and arbitrary data. Managed integrations supports WebRTC to enable these types of streaming between a customer mobile application and an end-user's device. For more information on the WebRTC standard, see [WebRTC](https://webrtc.org/). @@ -102 +121 @@ The WebRTC standard allows communication between two peers. These peers can tran - "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managedThing/6a7e8feb-b491-4cf7-a9f1-bf3703467718" + "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managed-thing/6a7e8feb-b491-4cf7-a9f1-bf3703467718" @@ -115,0 +135,22 @@ The WebRTC standard allows communication between two peers. These peers can tran + * `DEVICE_DISCOVERY_STATUS` + + * The discovery status of the device. + + { + "version":"0", + "messageId":"6a7e8feb-b491-4cf7-a9f1-bf3703467718", + "messageType":"DEVICE_DISCOVERY_STATUS", + "source":"aws.iotmanagedintegrations", + "customerAccountId":"123456789012", + "timestamp":"2017-12-22T18:43:48Z", + "region":"ca-central-1", + "resources":[ + "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managed-thing/6a7e8feb-b491-4cf7-a9f1-bf3703467718" + ], + "payload":{ + "deviceCount": 1, + "deviceDiscoveryId": "123", + "status": "SUCCEEDED" + } + } + @@ -128 +169 @@ The WebRTC standard allows communication between two peers. These peers can tran - "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managed-thing/1b15b39992f9460ba82c6c04595d1f4f" + "/quit/1b15b39992f9460ba82c6c04595d1f4f" @@ -157 +198 @@ The WebRTC standard allows communication between two peers. These peers can tran - "region": "us-west-2", + "region": "ca-central-1", @@ -159 +200 @@ The WebRTC standard allows communication between two peers. These peers can tran - "arn:aws:iotmanagedintegrations:us-west-2:123456789012:managed-thing/d5c280b423a042f3933eed09cf408657" + "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managed-thing/d5c280b423a042f3933eed09cf408657" @@ -164 +205 @@ The WebRTC standard allows communication between two peers. These peers can tran - "arn": "arn:aws:iotmanagedintegrations:us-west-2:123456789012:managed-thing/d5c280b423a042f3933eed09cf408657", + "arn": "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managed-thing/d5c280b423a042f3933eed09cf408657", @@ -186 +227 @@ The WebRTC standard allows communication between two peers. These peers can tran - "arn:aws:iotmanagedintegrations:us-west-2:123456789012:managed-thing/61889008880012345678" + "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:managed-thing/61889008880012345678" @@ -220 +261 @@ Device commands and events -Hub SDK +Cloud-to-Cloud (C2C) connectors