AWS iot-sitewise high security documentation change
Summary
Added detailed Docker Compose configuration for SiteWise Edge deployment including InfluxDB, Grafana, and Node-RED services with environment variables, network settings, and security credentials
Security assessment
The changes introduce security-related configurations including: 1) InfluxDB admin password/token injection via environment variables 2) Grafana admin password configuration 3) Disabled TLS verification in InfluxDB datasource (tlsSkipVerify: true) 4) Node-RED credentialSecret: false and null adminAuth. The TLS verification disablement and lack of authentication in Node-RED represent concrete security risks by reducing transport security and access controls.
Diff
diff --git a/iot-sitewise/latest/userguide/linux-docker-setup.md b/iot-sitewise/latest/userguide/linux-docker-setup.md index 386575eb5..39a9b0679 100644 --- a//iot-sitewise/latest/userguide/linux-docker-setup.md +++ b//iot-sitewise/latest/userguide/linux-docker-setup.md @@ -49,0 +50,485 @@ This deployment runs SiteWise Edge, InfluxDB, Node-RED, and Grafana on the same +### Prepare the Docker Compose file + +Copy the contents of the following YAML file to your SiteWise Edge gateway device. + + + services: + influxdb: + image: influxdb:latest + container_name: influxdb + ports: + - "127.0.0.1:8086:8086" + volumes: + - influxdb-storage:/.influxdbv2 + environment: + - DOCKER_INFLUXDB_INIT_MODE=setup + - DOCKER_INFLUXDB_INIT_USERNAME=admin + - DOCKER_INFLUXDB_INIT_PASSWORD=${INFLUXDB_PASSWORD} + - DOCKER_INFLUXDB_INIT_ORG=iot-sitewise-edge + - DOCKER_INFLUXDB_INIT_BUCKET=WindFarmData + - DOCKER_INFLUXDB_INIT_RETENTION=0 + - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=${INFLUXDB_TOKEN} + networks: + - SiteWiseEdgeNodeRedDemoNetwork + restart: unless-stopped + + grafana: + image: grafana/grafana:latest + container_name: grafana + ports: + - "127.0.0.1:3000:3000" + volumes: + - grafana-storage:/var/lib/grafana + - ./grafana/provisioning:/etc/grafana/provisioning + environment: + - GF_SECURITY_ADMIN_USER=admin + - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD} + - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource + - GF_PATHS_PROVISIONING=/etc/grafana/provisioning + - GF_PATHS_CONFIG=/etc/grafana/grafana.ini + - GF_LOG_LEVEL=info + configs: + - source: grafana_datasource + target: /etc/grafana/provisioning/datasources/influxdb.yaml + - source: grafana_preload_dashboard_config + target: /etc/grafana/provisioning/dashboards/dashboard.yml + - source: grafana_preload_dashboard + target: /etc/grafana/provisioning/dashboards/demo_dashboard.json + depends_on: + - influxdb + networks: + - SiteWiseEdgeNodeRedDemoNetwork + restart: unless-stopped + + nodered: + build: + context: . + dockerfile_inline: | + FROM nodered/node-red:latest + RUN npm install node-red-contrib-influxdb + container_name: nodered + ports: + - "127.0.0.1:1880:1880" + volumes: + - node_red_data:/data + environment: + - NODE_RED_ENABLE_SAFE_MODE=false + - NODE_RED_ENABLE_PALETTE_EDIT=true + - NODE_RED_AUTO_INSTALL_MODULES=true + configs: + - source: nodered_flows + target: /data/flows.json + - source: nodered_settings + target: /data/settings.js + - source: nodered_flows_cred + target: /data/flows_cred.json + depends_on: + - influxdb + networks: + - SiteWiseEdgeNodeRedDemoNetwork + restart: unless-stopped + + volumes: + influxdb-storage: + grafana-storage: + node_red_data: + + networks: + SiteWiseEdgeNodeRedDemoNetwork: + external: true + + configs: + grafana_datasource: + content: | + apiVersion: 1 + datasources: + - name: windfarm-demo + type: influxdb + access: proxy + url: http://influxdb:8086 + jsonData: + version: Flux + organization: iot-sitewise-edge + defaultBucket: WindFarmData + tlsSkipVerify: true + secureJsonData: + token: ${INFLUXDB_TOKEN} + editable: false + + grafana_preload_dashboard_config: + content: | + apiVersion: 1 + providers: + - name: "Dashboard provider" + orgId: 1 + type: file + options: + path: /etc/grafana/provisioning/dashboards + + grafana_preload_dashboard: + content: | + { + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": { + "type": "grafana", + "uid": "-- Grafana --" + }, + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "editable": true, + "fiscalYearStartMonth": 0, + "graphTooltip": 0, + "id": 1, + "links": [], + "panels": [ + { + "datasource": { + "type": "influxdb", + "uid": "PEB0DCBF338B3CEB2" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "barWidthFactor": 0.6, + "drawStyle": "line", + "fillOpacity": 0, + "gradientMode": "none", + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 1, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "auto", + "spanNulls": false, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green" + }, + { + "color": "red",