AWS code-library medium security documentation change
Summary
Added Python SDK (Boto3) code example for DetachThingPrincipal API demonstrating how to detach certificates from IoT things
Security assessment
The change documents certificate detachment from IoT devices, a security operation that revokes access credentials. Detaching principals prevents unauthorized access if certificates are compromised, directly impacting device security.
Diff
diff --git a/code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md b/code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md index caacd74ca..ed3622b89 100644 --- a//code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md +++ b//code-library/latest/ug/iot_example_iot_DetachThingPrincipal_section.md @@ -220,0 +221,59 @@ There's more on GitHub. Find the complete example and learn how to set up and ru +Python + + +**SDK for Python (Boto3)** + + +###### Note + +There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iot#code-examples). + + + class IoTWrapper: + """Encapsulates AWS IoT actions.""" + + def __init__(self, iot_client, iot_data_client=None): + """ + :param iot_client: A Boto3 AWS IoT client. + :param iot_data_client: A Boto3 AWS IoT Data Plane client. + """ + self.iot_client = iot_client + self.iot_data_client = iot_data_client + + @classmethod + def from_client(cls): + iot_client = boto3.client("iot") + iot_data_client = boto3.client("iot-data") + return cls(iot_client, iot_data_client) + + def detach_thing_principal(self, thing_name, principal): + """ + Detaches a certificate from an AWS IoT thing. + + :param thing_name: The name of the thing. + :param principal: The ARN of the certificate. + """ + try: + self.iot_client.detach_thing_principal( + thingName=thing_name, principal=principal + ) + logger.info("Detached principal %s from thing %s.", principal, thing_name) + except ClientError as err: + if err.response["Error"]["Code"] == "ResourceNotFoundException": + logger.error("Cannot detach principal. Resource not found.") + return + logger.error( + "Couldn't detach principal from thing. Here's why: %s: %s", + err.response["Error"]["Code"], + err.response["Error"]["Message"], + ) + raise + + + + + * For API details, see [DetachThingPrincipal](https://docs.aws.amazon.com/goto/boto3/iot-2015-05-28/DetachThingPrincipal) in _AWS SDK for Python (Boto3) API Reference_. + + + +