AWS wellarchitected documentation change
Summary
Restructured firmware update guidance, added four new best practices (IOTREL08-BP01 to IOTREL08-BP04) for secure OTA updates, rollback capabilities, incremental deployments, and dynamic configuration management. Added IOTREL09-BP01 for IoT device simulation testing.
Security assessment
The changes emphasize secure firmware update mechanisms (e.g., AWS IoT Jobs with MQTT/HTTPS), certificate rotation via Device Management, and secure tunneling. While these are security best practices, there is no explicit reference to addressing a specific vulnerability or incident. The updates proactively document security-focused processes rather than remediating a disclosed issue.
Diff
diff --git a/wellarchitected/latest/iot-lens/change-management.md b/wellarchitected/latest/iot-lens/change-management.md index f5ea78ab9..99c1c7c6c 100644 --- a//wellarchitected/latest/iot-lens/change-management.md +++ b//wellarchitected/latest/iot-lens/change-management.md @@ -3 +3,3 @@ -[Documentation](/index.html)[AWS Well-Architected](https://aws.amazon.com/architecture/well-architected/)[AWS Well-Architected Framework](abstract-and-introduction.html) +[Documentation](/index.html)[AWS Well-Architected](https://aws.amazon.com/architecture/well-architected/)[AWS Well-Architected Framework](iot-lens.html) + +IOTREL08-BP01 Use a mechanism to deploy and monitor firmware updatesIOTREL08-BP02 Configure firmware rollback capabilities in devicesIOTREL08-BP03 Implement support for incremental updates to target device groupsIOTREL08-BP04 Implement dynamic configuration management for devicesIOTREL09-BP01 Implement device simulation to synthesize the entire flow of IoT data @@ -7 +9 @@ -IOTREL 07. How do you ensure that you can reliably update device firmware from your IoT application? +IOTREL08: How do you update device firmware on your IoT device? @@ -10 +12,20 @@ IOTREL 07. How do you ensure that you can reliably update device firmware from y -It is important to implement the capability to revert to a previous version of your device firmware or your cloud application in the event of a failed rollout. If your application is well architected, you will capture metrics from the device, as well as metrics generated by AWS IoT Core, AWS IoT Greengrass and AWS IoT Device Defender. You will also be alerted when your device canaries deviate from expected behavior after any cloud-side changes. Based on any deviations in your operational metrics, you need the ability to: +It is important to implement the capability to revert to a previous version of your device firmware or your cloud application in the event of a failed rollout. If your application is well-architected, you will capture metrics from the device, as well as metrics generated by AWS IoT Core and AWS IoT Greengrass. You will also be alerted when your device canaries deviate from expected behavior after any cloud-side changes. + +## IOTREL08-BP01 Use a mechanism to deploy and monitor firmware updates + +When performing over-the-air (OTA) updates to remote devices' firmware, make sure that the updates are controlled and reversible to avoid functional impact of the device to the user, or the device entering a non-recoverable state. Use tools that allow you to deploy and track management tasks in your device fleet. + +**Level of risk exposed if this best practice is not established:** Low + +**Prescriptive guidance IOTREL08-BP01-01** _Use a cloud-based update orchestrator to deploy your firmware._ + + * You can use AWS IoT Jobs to send remote actions to one or many devices at once, control the deployment of jobs to your devices, and track the current and past status of job executions for each device. + + * Using FreeRTOS OTA using AWS IoT Jobs: By using AWS IoT Jobs for FreeRTOS, you have reliability and security provided out of the box where OTA update job will send firmware to your end device over secure MQTT or HTTPS and system reserved topics are provided to keep track on the status of the job schedule. + + * Using custom IoT jobs with AWS IoT connected devices: By using AWS IoT Jobs with one or more devices connected to AWS IoT gives you the ability to track the full roll out of the update. + + + + +**Prescriptive guidance IOTREL08-BP01-02** _Version all of the device firmware artifacts._ @@ -22 +43 @@ It is important to implement the capability to revert to a previous version of y - * Version all downstream AWS Cloud resources using CloudFormation. + * Version all downstream AWS Cloud resources using AWS CloudFormation. @@ -24 +45 @@ It is important to implement the capability to revert to a previous version of y - * Implement a rollback strategy for reverting cloud side changes using CloudFormation and other infrastructure as code tools. + * Implement a rollback strategy for reverting cloud side changes using AWS CloudFormation and other infrastructure as code tools. @@ -29 +50 @@ It is important to implement the capability to revert to a previous version of y -Treating your infrastructure as code on AWS allows you to automate monitoring and change management for your IoT application. Version all of the device firmware artifacts and ensure that updates can be verified, installed, or rolled back when necessary. +Treating your infrastructure as code on AWS allows you to automate monitoring and change management for your IoT application. Make sure that updates can be verified, installed, or rolled back when necessary. @@ -33 +54 @@ Devices will need new features over time for better user experience and the firm -**Best practice IOTREL_7.1 – Use a mechanism to deploy and monitor firmware updates** +## IOTREL08-BP02 Configure firmware rollback capabilities in devices @@ -35 +56 @@ Devices will need new features over time for better user experience and the firm -When performing over-the-air (OTA) updates to remote devices’ firmware, we should always ensure that the updates are controlled and reversible to avoid functional impact of the device to the user, or the device entering a non-recoverable state. Use tools that allow you to deploy and track management tasks in your device fleet. +Augment hardware with software to hold two versions of firmware and the ability to switch between them. Devices can rapidly roll back to older firmware if the new firmware has issues. @@ -37 +58 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho -**Recommendation IOTREL_7.1.1** – _Use a cloud-based update orchestrator to deploy your firmware_ +**Level of risk exposed if this best practice is not established:** Medium @@ -39 +60 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho - * You can use AWS IoT Jobs to send remote actions to one or many devices at once, control the deployment of jobs to your devices, and track the current and past status of job executions for each device. +**Prescriptive guidance IOTREL08-BP02-01** _Leverage an RTOS with functionality to roll back device firmware._ @@ -41 +62 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho - * Using FreeRTOS OTA using AWS IoT Jobs: By using AWS IoT Jobs for FreeRTOS, you have reliability and security provided out of the box where OTA update job will send firmware to your end device over secure MQTT or HTTPS and system reserved topics are provided to keep track on the status of the job schedule. +By combining OTA agents provided by FreeRTOS or using AWS IoT Device SDK, you can create flexibility to hold two versions of firmware with the hardware that is capable of storing it. @@ -43 +64 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho - * Using custom IoT jobs with AWS IoT connected devices: By using AWS IoT Jobs with one or more devices connected to AWS IoT gives you the ability to track the full roll out of the update. +## IOTREL08-BP03 Implement support for incremental updates to target device groups @@ -44,0 +66 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho +It is a good practice to test new firmware on a small group of devices. Using a smaller group of devices for firmware updates helps make sure that the firmware as well as the upgrade process is well tested before the entire fleet is updated. @@ -45,0 +68 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho +**Level of risk exposed if this best practice is not established:** Medium @@ -46,0 +70 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho +**Prescriptive guidance IOTREL08-BP03-01** _Use a cloud orchestrator in conjunction with device settings augmentation. Cloud services can help you control and manage jobs in tandem with the devices running the jobs._ @@ -48 +72 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho -**Best practice IOTREL_7.2 – Implement firmware rollback capabilities in devices** + * The AWS IoT Jobs API provides a granular level of control from the cloud to the device for carrying out firmware update incrementally and roll back as needed. @@ -50 +74 @@ When performing over-the-air (OTA) updates to remote devices’ firmware, we sho -Augment hardware with software to hold two versions of firmware and the ability to switch between them. Devices can rapidly roll back to older firmware if the new firmware has issues. + * A job document created as part of AWS IoT job details the remote operations the device needs to perform. This includes shutting down rollouts based on timeouts, number of updates per device among other things. Devices can use this information to reject or accept firmware updates. @@ -52 +75,0 @@ Augment hardware with software to hold two versions of firmware and the ability -**Recommendation IOTREL_7.2.1** – _Leverage an RTOS with functionality to roll back device firmware_ @@ -54 +76,0 @@ Augment hardware with software to hold two versions of firmware and the ability -By combining OTA agents provided by FreeRTOS or using AWS IoT Device SDK, you can create flexibility to hold two versions of firmware with the hardware that is capable of storing it. @@ -56 +77,0 @@ By combining OTA agents provided by FreeRTOS or using AWS IoT Device SDK, you ca -**Best practice IOTREL_7.3 – Implement support for incremental updates to target device groups** @@ -58 +79 @@ By combining OTA agents provided by FreeRTOS or using AWS IoT Device SDK, you ca -It’s a good practice to test new firmware on a small group of devices. Using a smaller group of devices for firmware updates helps ensure that the firmware as well as the upgrade process is well tested before the entire fleet is updated. +## IOTREL08-BP04 Implement dynamic configuration management for devices @@ -60 +81 @@ It’s a good practice to test new firmware on a small group of devices. Using a -**Recommendation IOTREL_7.3.1** – _Use a cloud orchestrator in conjunction with device settings augmentation. Cloud services can help you control and manage jobs in tandem with the devices running the jobs._ +Deploying software changes to devices constitutes a high-risk operation due to the recovery cost associated with remotely deployed devices. When possible, prefer mechanisms for making changes using command-and-control channels to reduce the risk that comes with software deployments and firmware upgrades. This approach enables you to push some changes to devices while minimizing the risk of entering fault states that require on-premises recovery actions. Configuration changes reduce the amount of bandwidth compared to firmware updates. @@ -62 +83 @@ It’s a good practice to test new firmware on a small group of devices. Using a - * The AWS IoT Jobs API provides a granular level of control from the cloud to the device for carrying out firmware update incrementally and roll back as needed. +**Level of risk exposed if this best practice is not established:** Medium @@ -64 +85 @@ It’s a good practice to test new firmware on a small group of devices. Using a - * A job document created as part of AWS IoT job details the remote operations the device needs to perform. This includes shutting down rollouts based on timeouts, number of updates per device among other things. Devices can use this information to reject or accept firmware updates. +**Prescriptive guidance IOTREL08-BP04-01** _Use cloud tools to command and control devices. Changing configuration of devices is less error prone and easier to trace back than updating firmware._ @@ -65,0 +87 @@ It’s a good practice to test new firmware on a small group of devices. Using a + * Use Secure Tunneling or Systems Manager to facilitate patching of the operating system instead of pushing a new image to be loaded on the device. @@ -66,0 +89 @@ It’s a good practice to test new firmware on a small group of devices. Using a + * Use Device Shadows to command-and-control devices rather than sending commands directly to device. @@ -67,0 +91 @@ It’s a good practice to test new firmware on a small group of devices. Using a + * Use AWS IoT Device Management jobs to rotate expiring device certificates instead of pushing a new image with updated certificates. @@ -69 +93 @@ It’s a good practice to test new firmware on a small group of devices. Using a -**Best practice IOTREL_7.4 – Implement dynamic configuration management for devices** + * [AWS IoT secure tunneling](https://docs.aws.amazon.com/iot/latest/developerguide/secure-tunneling.html) @@ -71 +95,21 @@ It’s a good practice to test new firmware on a small group of devices. Using a -Deploying software changes to devices constitutes a high-risk operation due to the recovery cost associated with remotely deployed devices. When possible, prefer mechanisms for making changes using command-and-control channels to reduce the risk that comes with software deployments and firmware upgrades. This approach enables you to push some changes to devices while minimizing the risk of entering fault states that require on-premises recovery actions. Configuration changes reduces the amount of bandwidth compared to firmware updates. + * [AWS IoT Device Shadow service](https://docs.aws.amazon.com/iot/latest/developerguide/iot-device-shadows.html) + + + + +IOTREL09: How do you perform functional testing for your IoT solution? +--- + +Testing IoT applications and backend services is expensive and can be a challenge due to the large pool of physical, connected devices required. Simulation helps test device integration and IoT backend services, without the need for physical devices. You can also monitor devices from the simulator or observe how backend services are processing the data. + +## IOTREL09-BP01 Implement device simulation to synthesize the entire flow of IoT data + +Simulation scenarios can be configured to generate high volumes of traffic, simulating a large number of IoT devices interacting with the infrastructure simultaneously. By analyzing metrics such as message throughput, latency, and error rates during load testing, users can identify potential bottlenecks and optimize their infrastructure for reliability and responsiveness. + +**Level of risk exposed if this best practice is not established:** Low + +**Prescriptive guidance IOTREL09-BP01-01** _To augment your production device deployments, implement IoT simulations on Amazon Elastic Compute Cloud (Amazon EC2) as device canaries across several AWS Regions._ + + * These device canaries are responsible for mirroring several of your business use cases, such as simulating error conditions like long-running transactions, sending telemetry, and implementing control operations. The device simulation framework must output extensive metrics, including but not limited to successes, errors, latency, and device ordering and then transmit all the metrics to your operations system. + + * You must implement a variety of device simulation canaries that continue to test common device interactions directly against your production system. Device canaries assist in narrowing down the potential areas to investigate when operational metrics are not met. Device canaries can be used to raise preemptive alarms when the canary metrics fall below your expected SLA. @@ -73 +116,0 @@ Deploying software changes to devices constitutes a high-risk operation due to t -**Recommendation IOTREL_7.4.1** – _Use cloud tools to command-and-control devices. Changing configuration of devices is less error prone and easier to trace back than updating firmware._ @@ -75 +117,0 @@ Deploying software changes to devices constitutes a high-risk operation due to t - * Use Secure Tunneling or AWS Systems Manager to facilitate patching of the operating system instead of pushing a new image to be loaded on the device. @@ -77 +118,0 @@ Deploying software changes to devices constitutes a high-risk operation due to t - * Use Device Shadows to command-and-control devices rather than sending commands directly to device. @@ -79 +120 @@ Deploying software changes to devices constitutes a high-risk operation due to t - * Use AWS IoT Device Defender and AWS IoT Device Management jobs to rotate expiring device certificates instead of pushing a new image with updated certificates. +**Prescriptive guidance IOTREL09-BP01-02** _The IoT Device Simulator simulates diverse scenarios to validate the logic and functionality of their IoT applications._ @@ -81 +122 @@ Deploying software changes to devices constitutes a high-risk operation due to t - * [Secure Tunneling](https://docs.aws.amazon.com/iot/latest/developerguide/secure-tunneling.html) + * Launch fleets of virtually connected devices from a user-defined template and then simulate them to publish data at regular intervals to AWS IoT @@ -83 +124 @@ Deploying software changes to devices constitutes a high-risk operation due to t - * [Device Shadows](https://docs.aws.amazon.com/iot/latest/developerguide/iot-device-shadows.html) + * Simulation scenarios can be utilized to generate synthetic data for training ML models used in IoT applications. By simulating different environmental conditions, device behaviors, and data patterns, users can generate diverse datasets to train and validate ML algorithms. @@ -85 +125,0 @@ Deploying software changes to devices constitutes a high-risk operation due to t - * [Device Defender](https://docs.aws.amazon.com/iot/latest/developerguide/device-defender.html) @@ -88,0 +129 @@ Deploying software changes to devices constitutes a high-risk operation due to t +For more information see, [IoT Device Simulator](https://aws.amazon.com/solutions/implementations/iot-device-simulator/). @@ -96 +137 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Foundations +Workload architecture