AWS iot documentation change
Summary
Added API_INITIATED_DISCONNECT reason and clarified LWT message behavior with footnotes. Introduced 'preventWillMessage=true' parameter to override default LWT behavior for API disconnects.
Security assessment
The change documents how to prevent Last Will and Testament (LWT) messages during API-initiated disconnects, which could help avoid unintended data exposure. While this relates to security controls (message suppression), there's no evidence it addresses a specific vulnerability. The update primarily enhances documentation about existing security-related functionality.
Diff
diff --git a/iot/latest/developerguide/life-cycle-events.md b/iot/latest/developerguide/life-cycle-events.md index 6c250db77..31cac7c7c 100644 --- a//iot/latest/developerguide/life-cycle-events.md +++ b//iot/latest/developerguide/life-cycle-events.md @@ -71,12 +71,17 @@ Disconnect reason | Description | The broker will send the LWT messages -`AUTH_ERROR` | The client failed to authenticate or authorization failed. | Yes. If the device has an active connection before receiving this error. -`CLIENT_INITIATED_DISCONNECT` | The client indicates that it will disconnect. The client can do this by sending either a MQTT `DISCONNECT` control packet or a `Close frame` if the client is using a WebSocket connection. | No. -`CLIENT_ERROR` | The client did something wrong that causes it to disconnect. For example, a client will be disconnected for sending more than 1 MQTT `CONNECT` packet on the same connection or if the client attempts to publish with a payload that exceeds the payload limit. | Yes. -`CONNECTION_LOST` | The client-server connection is cut off. This can happen during a period of high network latency or when the internet connection is lost. | Yes. -`DUPLICATE_CLIENTID` | The client is using a client ID that is already in use. In this case, the client that is already connected will be disconnected with this disconnect reason. | Yes. -`FORBIDDEN_ACCESS` | The client is not allowed to be connected. For example, a client with a denied IP address will fail to connect. | Yes. If the device has an active connection before receiving this error. -`MQTT_KEEP_ALIVE_TIMEOUT` | If there is no client-server communication for 1.5x of the client's keep-alive time, the client is disconnected. | Yes. -`SERVER_ERROR` | Disconnected due to unexpected server issues. | Yes. -`SERVER_INITIATED_DISCONNECT` | Server intentionally disconnects a client for operational reasons. | Yes. -`THROTTLED` | The client is disconnected for exceeding a throttling limit. | Yes. -`WEBSOCKET_TTL_EXPIRATION` | The client is disconnected because a WebSocket has been connected longer than its time-to-live value. | Yes. -`CUSTOMAUTH_TTL_EXPIRATION` | The client is disconnected because it has been connected longer than the time-to-live value of its custom authorizer. | Yes. +`AUTH_ERROR` | The client failed to authenticate or authorization failed. | Yes1 +`CLIENT_INITIATED_DISCONNECT` | The client indicates that it will disconnect. The client can do this by sending either a MQTT `DISCONNECT` control packet or a `Close frame` if the client is using a WebSocket connection. | No +`CLIENT_ERROR` | The client did something wrong that causes it to disconnect. For example, a client will be disconnected for sending more than 1 MQTT `CONNECT` packet on the same connection or if the client attempts to publish with a payload that exceeds the payload limit. | Yes +`CONNECTION_LOST` | The client-server connection is cut off. This can happen during a period of high network latency or when the internet connection is lost. | Yes +`DUPLICATE_CLIENTID` | The client is using a client ID that is already in use. In this case, the client that is already connected will be disconnected with this disconnect reason. | Yes +`FORBIDDEN_ACCESS` | The client is not allowed to be connected. For example, a client with a denied IP address will fail to connect. | Yes1 +`MQTT_KEEP_ALIVE_TIMEOUT` | If there is no client-server communication for 1.5x of the client's keep-alive time, the client is disconnected. | Yes +`SERVER_ERROR` | Disconnected due to unexpected server issues. | Yes +`SERVER_INITIATED_DISCONNECT` | Server intentionally disconnects a client for operational reasons. | Yes +`API_INITIATED_DISCONNECT` | The client was disconnected using the `DeleteConnection` API. | Yes2 +`THROTTLED` | The client is disconnected for exceeding a throttling limit. | Yes +`WEBSOCKET_TTL_EXPIRATION` | The client is disconnected because a WebSocket has been connected longer than its time-to-live value. | Yes +`CUSTOMAUTH_TTL_EXPIRATION` | The client is disconnected because it has been connected longer than the time-to-live value of its custom authorizer. | Yes + +1If the device has an active connection before receiving this error. + +2To prevent Last Will and Testament (LWT) messages, set `preventWillMessage=true` to override the `DeleteConnection` API's default LWT sending behavior.