AWS iot-wireless medium security documentation change
Summary
Added documentation for device location features including Bluetooth Low Energy-based positioning, usage restrictions for gateway location data, and configuration requirements. Updated API references and CLI examples to include new 'Positioning' parameters.
Security assessment
The changes introduce strict usage restrictions for gateway location data (prohibiting reverse engineering/re-mapping) and clarify that enabling location features disables raw payload propagation. These additions enforce data handling policies and limit potential misuse of sensitive location information, addressing privacy/security concerns.
Diff
diff --git a/iot-wireless/latest/developerguide/sidewalk-bulk-provision-how.md b/iot-wireless/latest/developerguide/sidewalk-bulk-provision-how.md index 13d30225b..9c6f959f2 100644 --- a//iot-wireless/latest/developerguide/sidewalk-bulk-provision-how.md +++ b//iot-wireless/latest/developerguide/sidewalk-bulk-provision-how.md @@ -36,0 +37,12 @@ Depending on the method that you chose to onboard your devices, add the device i + 4. (Optional) A **Location Destination** where you want to send the device location data, after you enable location data when you create your Sidewalk end device with AWS IoT Core for Amazon Sidewalk. For more information on AWS IoT's location resolution capabilities, see [AWS IoT Core Device Location](https://docs.aws.amazon.com/iot/latest/developerguide/device-location.html) AWS services. + +###### Note + +For Bluetooth Low Energy based location, AWS IoT returns location coordinates based on the approximate location of nearby Sidewalk Gateways that are connected to Amazon Sidewalk and have the Community Finding feature enabled. Gateway Location Data is AWS Content and is provided to you solely for the purpose of assisting you in locating your devices that are connected to Amazon Sidewalk, and you must only use the data for that purpose. You must only use and access location data via the interface and functionality that we generally make available to you, and you must not attempt to re-identify, reverse engineer, or re-map any Gateway location data provided by us to you. + +###### Note + +You must enable positioning to use the device location feature. + +If you enable device location for the Sidewalk-enabled device, your raw uplink payload won't be propagated to the destination. + @@ -39 +51 @@ Depending on the method that you chose to onboard your devices, add the device i - 1. Provide the **S3 Bucket destination** information, which consists of the S3 URL information. To provide your CSV file, choose **Browse S3** , and then choose the CSV file you want to use. + 1. Provide the **S3 Bucket** information, which consists of the S3 URL information. To provide your CSV file, choose **Browse S3** , and then choose the CSV file you want to use. @@ -47 +59,13 @@ To create a new role, you can either provide a **Role name** or leave it blank t - 3. Provide a **Destination** that describes the IoT rule to route messages from the device to other AWS servicess. + 3. Provide a **Destination** that describes the IoT rule to route messages from the device to other AWS services. + + 4. (Optional) A **Location Destination** where you want to send the device location data, after you enable location data when you create your Sidewalk end device with AWS IoT Core for Amazon Sidewalk. For more information on AWS IoT's location resolution capabilities, see [AWS IoT Core Device Location](https://docs.aws.amazon.com/iot/latest/developerguide/device-location.html) AWS services. + +###### Note + +For Bluetooth Low Energy based location, AWS IoT returns location coordinates based on the approximate location of nearby Sidewalk Gateways that are connected to Amazon Sidewalk and have the Community Finding feature enabled. Gateway Location Data is AWS Content and is provided to you solely for the purpose of assisting you in locating your devices that are connected to Amazon Sidewalk, and you must only use the data for that purpose. You must only use and access location data via the interface and functionality that we generally make available to you, and you must not attempt to re-identify, reverse engineer, or re-map any Gateway location data provided by us to you. + +###### Note + +You must enable positioning to use the device location feature. + +If you enable device location for the Sidewalk-enabled device, your raw uplink payload won't be propagated to the destination. @@ -62 +86 @@ To onboard your Sidewalk devices to your account for AWS IoT Core for Amazon Sid -To upload devices in bulk by providing the CSV file in an S3 bucket, use the [`StartWirelessDeviceImportTask`](https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartWirelessDeviceImportTask.html) API operation, or the [`start-wireless-device-import-task`](https://docs.aws.amazon.com/cli/latest/reference/iotwireless/start-wireless-device-import-task.html) AWS CLI command. When creating the task, specify the path to the CSV file in the Amazon S3 bucket and the IAM role that grants AWS IoT Core for Amazon Sidewalk permissions to access the CSV file. +To upload devices in bulk by providing the CSV file in an S3 bucket, use the [`StartWirelessDeviceImportTask`](https://docs.aws.amazon.com/iot-wireless/latest/apireference/API_StartWirelessDeviceImportTask.html) API operation, or the [`start-wireless-device-import-task`](https://docs.aws.amazon.com/cli/latest/reference/iotwireless/start-wireless-device-import-task.html) AWS CLI command. When creating the task, specify the path to the CSV file in the Amazon S3 bucket and the IAM role that grants AWS IoT Core for Amazon Sidewalk permissions to access the CSV file. @@ -76,0 +101 @@ The following shows the contents of the file `task.json`. + "Positioning": "Enabled" @@ -79 +104,4 @@ The following shows the contents of the file `task.json`. - "Role": "arn:aws:iam::123456789012:role/service-role/ACF1zBEI" + "Role": "arn:aws:iam::123456789012:role/service-role/ACF1zBEI", + "Positioning": { + DestinationName": "Sidewalk_Location_Destination" + } @@ -92 +120 @@ Running this command returns an ID and ARN for the import task. -To provision devices individually using their SMSN, use the [`StartSingleWirelessDeviceImportTask`](https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartSingleWirelessDeviceImportTask.html) API operation, or the [`start-single-wireless-device-import-task`](https://docs.aws.amazon.com/cli/latest/reference/iotwireless/start-single-wireless-device-import-task.html) AWS CLI command. When creating the task, specify the Sidewalk destination and the serial number of the device that you want to onboard. +To provision devices individually using their SMSN, use the [`StartSingleWirelessDeviceImportTask`](https://docs.aws.amazon.com/iot-wireless/latest/apireference/API_StartSingleWirelessDeviceImportTask.html) API operation, or the [`start-single-wireless-device-import-task`](https://docs.aws.amazon.com/cli/latest/reference/iotwireless/start-single-wireless-device-import-task.html) AWS CLI command. When creating the task, specify the Sidewalk destination and the serial number of the device that you want to onboard. @@ -100 +128,8 @@ The following command shows an example of creating an import task: - --sidewalk '{"SidewalkManufacturingSn": "82B83C8B35E856F43CE9C3D59B418CC96B996071016DB1C3BE5901F0F3071A4A"}' + --positioning Enabled \ + --sidewalk '{ + "SidewalkManufacturingSn": "82B83C8B35E856F43CE9C3D59B418CC96B996071016DB1C3BE5901F + 0F3071A4A"}', + "Positioning":{ + DestinationName": sidewalk_location_destination + } + }' @@ -144 +179 @@ Use the following AWS IoT Wireless API operations or CLI commands to update or d - * ###### [`UpdateWirelessDeviceImportTask`](https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateWirelessDeviceImportTask.html) API or [`update-wireless-device-import-task`](https://docs.aws.amazon.com/cli/latest/reference/update-wireless-device-import-task.html) CLI + * ###### [`UpdateWirelessDeviceImportTask`](https://docs.aws.amazon.com/iot-wireless/latest/apireference/API_UpdateWirelessDeviceImportTask.html) API or [`update-wireless-device-import-task`](https://docs.aws.amazon.com/cli/latest/reference/update-wireless-device-import-task.html) CLI @@ -148 +183 @@ This API operation appends the contents of an Amazon S3 CSV file to an existing - * ###### [`DeleteWirelessDeviceImportTask`](https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessDeviceImportTask.html) API or [`delete-wireless-device-import-task`](https://docs.aws.amazon.com/cli/latest/reference/delete-wireless-device-import-task.html) CLI + * ###### [`DeleteWirelessDeviceImportTask`](https://docs.aws.amazon.com/iot-wireless/latest/apireference/API_DeleteWirelessDeviceImportTask.html) API or [`delete-wireless-device-import-task`](https://docs.aws.amazon.com/cli/latest/reference/delete-wireless-device-import-task.html) CLI