AWS iot-sitewise medium security documentation change
Summary
Added configuration options for OPC UA data collection including default data change triggers, discovery settings with concurrent request limits, node loop prevention, periodic discovery intervals, and related component version requirements.
Security assessment
The 'avoidNodeTreeLoops' configuration explicitly prevents circular reference infinite loops during node browsing, which could lead to denial-of-service scenarios. The documentation also adds operational safety controls like request rate limiting and discovery interval caps that help prevent server/gateway overload.
Diff
diff --git a/iot-sitewise/latest/userguide/configure-opcua-source.md b/iot-sitewise/latest/userguide/configure-opcua-source.md index 0868ef2f9..77b7dd9c9 100644 --- a//iot-sitewise/latest/userguide/configure-opcua-source.md +++ b//iot-sitewise/latest/userguide/configure-opcua-source.md @@ -96 +96,29 @@ Your data server might have an option named **Allow anonymous login**. If this o - 5. (Optional) For **Property groups** , choose **Add new group**. + 5. Choose a **Default data change trigger** for nodes that are not contained in a user-defined property group. The default data change trigger determines when the OPC UA server sends updated values to the gateway. You can choose one of the following options: + + * **Status** – to receive data only when a status changes. + + * **StatusValue** – to receive data when a status or value changes. + + * **StatusValueTimestamp** – to receive data when a status, value, or timestamp changes. + + 6. (Optional) On an MQTT-enabled, V3 gateway, you can use **Discovery configuration** to configure the OPC UA node discovery process. Discovery configuration replaces the previous config override file system for these options with console-based settings that update dynamically without needing to restart the gateway. + +###### Note + +**Default data change trigger** requires version 3.1.0 or later of the IoT SiteWise OPC UA collector component. For more information, see [Update the version of an AWS IoT SiteWise component](./manage-gateways-ggv2.html#update-component-version). + + 1. For **Maximum concurrent browse request count** , enter the maximum number of browse requests that your OPC UA server can handle simultaneously. You can configure up to 500 concurrent browse requests per data source. + + 2. For **Maximum node count per browse request** , enter the maximum number of nodes to send in each browse request to the OPC UA server. You can send up to 1,000 nodes per browse request. + + 3. Choose **Avoid node tree loops** to prevent the gateway from getting stuck in circular references when browsing the OPC UA server's structure. When selected, the gateway tracks visited locations to avoid infinite loops that can occur when server nodes reference each other in a circular pattern. + + 4. Choose **Enable node traversal** to allow the gateway to explore the complete structure of your OPC UA server to discover all available data points from your equipment and devices. When selected, the gateway navigates through your equipment's data organization beyond the root level to find all sensors, controls, and measurement points automatically. + + 5. Choose **Enable periodic discovery** to automatically run discovery operations at regular intervals to detect changes in the OPC UA server's structure. When selected, the gateway continuously monitors for newly added equipment or data points, ensuring they are automatically detected and made available for data collection. + + 1. For **Periodic discovery interval** , set the time interval between automatic discovery operations when periodic discovery is running. The minimum periodic discovery interval is 30 seconds and the maximum is 30 days. + + 2. For **Maximum nodes discovered per interval** , set the maximum number of nodes that should be discovered per discovery interval. This helps control the load on both the gateway and the OPC UA server during discovery operations. + + 7. (Optional) For **Property groups** , choose **Add new group**. @@ -119 +147 @@ Subscribe - 2. **[Subscription queue size](https://reference.opcfoundation.org/v104/Core/docs/Part4/7.16/)** – The depth of the queue on an OPC–UA server for a particular metric where notifications for monitored items are queued. + 2. **[Subscription queue size](https://reference.opcfoundation.org/v104/Core/docs/Part4/7.16/)** – The depth of the queue on an OPC UA server for a particular metric where notifications for monitored items are queued. @@ -158 +186 @@ Poll -Use version 2.5.0 or later of the IoT SiteWise OPC UA collector component. If you use the timestamp feature with earlier versions, configuration updates fail. For more information, see [Update the version of an AWS IoT SiteWise component](./manage-gateways-ggv2.html#update-component-version). +Use version 3.1.0 or later of the IoT SiteWise OPC UA collector component. If you use the timestamp feature with earlier versions, configuration updates fail. For more information, see [Update the version of an AWS IoT SiteWise component](./manage-gateways-ggv2.html#update-component-version). @@ -220,0 +249,13 @@ This capability has the following namespace. + "defaultPropertyGroupConfig": { + "dataChangeTrigger": "STATUS" | "STATUS_VALUE" | "STATUS_VALUE_TIMESTAMP" + }, + "discoveryConfig": { + "enableNodeTraversal": true | false, + "avoidNodeTreeLoops": true | false, + "maxConcurrentBrowseRequests": integer, + "maxNodesPerBrowseRequest": integer, + "periodicDiscovery": { + "interval": "string", + "maxNodesDiscoveredPerInterval": integer + } + }, @@ -552,0 +594,62 @@ The buffer size of the stream. This is important for managing the flow of data f +`defaultPropertyGroupConfig` – _MQTT-enabled, V3 gateways only_ + + +(Optional) Configuration for the default property group. The default property group contains all nodes not otherwise contained in a user-defined property group. + +`dataChangeTrigger` + + +The default data change trigger to use in the default property group. Valid values are `STATUS_VALUE_TIMESTAMP`, `STATUS_VALUE`, or `STATUS`. + +###### Note + +`defaultPropertyGroupConfig` requires version 3.1.0 or later of the IoT SiteWise OPC UA collector component. For more information, see [Update the version of an AWS IoT SiteWise component](./manage-gateways-ggv2.html#update-component-version). + +`discoveryConfig` – _MQTT-enabled, V3 gateways only_ + + +(Optional) Configuration for the OPC UA node discovery process. + +`enableNodeTraversal` + + +Specifies whether to continue traversing child nodes of the root node defined by the data source's node filter. When set to `false`, discovery stops at the root node. + +`avoidNodeTreeLoops` + + +Specifies whether to avoid infinite loops during the OPC UA node browsing process. When set to `true`, the gateway tracks visited nodes to prevent circular references. + +`maxConcurrentBrowseRequests` + + +The maximum number of concurrent browse requests that your OPC UA server can handle simultaneously. Valid range is 1 to 500. + +`maxNodesPerBrowseRequest` + + +The maximum number of nodes to send in each browse request to the OPC UA server. Valid range is 1 to 1,000. + +`periodicDiscovery` + + +Configuration for running discovery periodically at fixed intervals. Periodic discovery is enabled when this configuration is provided. + +`interval` + + +The amount of time between periodic discovery operations. You can use `m` for minutes, `h` for hours, and `d` for days. For example, `90m` or `1h`. The minimum interval is 30 seconds. + +`maxNodesDiscoveredPerInterval` + + +The maximum number of nodes that should be discovered per discovery interval. This helps control the load on both the gateway and the OPC UA server. + +###### Note + +`periodicDiscovery` requires version 3.1.0 or later of the IoT SiteWise OPC UA collector component. For more information, see [Update the version of an AWS IoT SiteWise component](./manage-gateways-ggv2.html#update-component-version). + +###### Note + +If discovery loops infinitely, enable `avoidNodeTreeLoops`. Monitor discovery progress in CloudWatch logs under the `aws.iot.SiteWiseOpcUaCollector` component. +