AWS Security ChangesHomeSearch

AWS code-library medium security documentation change

Service: code-library · 2026-01-25 · Security-related medium

File: code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md

Summary

Added Python SDK (Boto3) code example for DetachThingPrincipal API demonstrating how to detach certificates from IoT things

Security assessment

The change documents certificate detachment from IoT devices, a security operation that revokes access credentials. Detaching principals prevents unauthorized access if certificates are compromised, directly impacting device security.

Diff

diff --git a/code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md b/code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md
index caacd74ca..ed3622b89 100644
--- a//code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md
+++ b//code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md
@@ -220,0 +221,59 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
+Python
+    
+
+**SDK for Python (Boto3)**
+    
+
+###### Note
+
+There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iot#code-examples). 
+    
+    
+    class IoTWrapper:
+        """Encapsulates AWS IoT actions."""
+    
+        def __init__(self, iot_client, iot_data_client=None):
+            """
+            :param iot_client: A Boto3 AWS IoT client.
+            :param iot_data_client: A Boto3 AWS IoT Data Plane client.
+            """
+            self.iot_client = iot_client
+            self.iot_data_client = iot_data_client
+    
+        @classmethod
+        def from_client(cls):
+            iot_client = boto3.client("iot")
+            iot_data_client = boto3.client("iot-data")
+            return cls(iot_client, iot_data_client)
+    
+        def detach_thing_principal(self, thing_name, principal):
+            """
+            Detaches a certificate from an AWS IoT thing.
+    
+            :param thing_name: The name of the thing.
+            :param principal: The ARN of the certificate.
+            """
+            try:
+                self.iot_client.detach_thing_principal(
+                    thingName=thing_name, principal=principal
+                )
+                logger.info("Detached principal %s from thing %s.", principal, thing_name)
+            except ClientError as err:
+                if err.response["Error"]["Code"] == "ResourceNotFoundException":
+                    logger.error("Cannot detach principal. Resource not found.")
+                    return
+                logger.error(
+                    "Couldn't detach principal from thing. Here's why: %s: %s",
+                    err.response["Error"]["Code"],
+                    err.response["Error"]["Message"],
+                )
+                raise
+    
+    
+    
+
+  * For API details, see [DetachThingPrincipal](https://docs.aws.amazon.com/goto/boto3/iot-2015-05-28/DetachThingPrincipal) in _AWS SDK for Python (Boto3) API Reference_. 
+
+
+
+