AWS prescriptive-guidance medium security documentation change
Summary
Restructured headers, added Node Operational Certificates (NOC) documentation, CRL revocation guidance for Matter 1.2+, and expanded AWS IoT Device Management integration details
Security assessment
Added specific security documentation about certificate revocation (CRL configuration with OmitExtension=true) and Node Operational Certificates for Matter fabric security. These changes directly relate to PKI security implementation requirements for Matter compliance.
Diff
diff --git a/prescriptive-guidance/latest/strategy-matter-standard/development-with-matter.md b/prescriptive-guidance/latest/strategy-matter-standard/development-with-matter.md index 9aece57ea..c50bfacb6 100644 --- a//prescriptive-guidance/latest/strategy-matter-standard/development-with-matter.md +++ b//prescriptive-guidance/latest/strategy-matter-standard/development-with-matter.md @@ -5 +5 @@ -Using AlexaAWS Private CA support for Matter +Using AlexaAWS Private CA support for MatterManaged integrations with AWS IoT Device Management @@ -13 +13 @@ Amazon offers a comprehensive suite of tools for Matter development. These tools -_Program: Works with Alexa_ +### Program: Works with Alexa @@ -17 +17 @@ This program ensures your Alexa-connected devices provide a great customer exper -_SDK: Develop Matter with Alexa_ +### SDK: Develop Matter with Alexa @@ -21 +21 @@ This SDK lets you add local Matter connectivity to your device while also includ -_Kit: Alexa Ambient Home Developer Kit_ +### Kit: Alexa Ambient Home Developer Kit @@ -25 +25 @@ This kit helps you integrate with devices across protocols in order to build an -_Endpoint: Commissionable Endpoint_ +### Endpoint: Commissionable Endpoint @@ -33 +33 @@ AWS Private Certificate Authority (AWS Private CA) provides guidance on using th -_DAC for Matter_ +### DAC for Matter @@ -48 +48,11 @@ For more information, see [Use AWS Private Certificate Authority to issue device -_Infrastructure for Matter_ +### Node Operational Certificates (NOC) + +In addition to device attestation, AWS Private CA supports issuing Node Operational Certificates (NOCs), which are used to secure communication within a Matter fabric. AWS provides Java samples for activating a root CA and subordinate CA for NOCs and creating a NOC. + +For more information, see [Using the AWS Private CA API to implement Matter certificates](https://docs.aws.amazon.com/privateca/latest/userguide/API-CBR-intro.html) in the AWS Private Certificate Authority documentation. + +### CRL Revocation Support (Matter version 1.2 and later) + +Matter version 1.2 introduced Device Attestation Certificate (DAC) revocation using Certificate Revocation Lists (CRLs). When enabling CRL revocation for CAs that issue Matter certificates, set `OmitExtension` to `true` in the `CrlConfiguration` object within the `CrlDistributionPointExtensionConfiguration` structure. In Matter, the CRL Distribution Point (CDP) URI is not embedded in certificates but is instead fetched from the Matter Distributed Compliance Ledger (DCL). You must upload the CDP URI to the Matter DCL for discovery during DAC validation. + +### Infrastructure for Matter @@ -52 +62 @@ AWS provides an example that demonstrates the use of [AWS Cloud Development Kit -_Java samples_ +### Java samples @@ -56 +66 @@ AWS Private CA provides Java samples for creating Matter-compliant Product Attes -_Guide for Matter PKI compliance_ +### Guide for Matter PKI compliance @@ -59,0 +70,21 @@ This [Matter PKI Compliance Guide](https://d1.awsstatic.com/whitepapers/complian +## Managed integrations with AWS IoT Device Management + +[AWS IoT Device Management](https://docs.aws.amazon.com/iot/latest/developerguide/iot-thing-management.html) includes the managed integrations feature, which provides a unified interface for onboarding and managing diverse IoT devices regardless of connection type (direct, hub-based, or cloud-to-cloud). + +The following are key capabilities relevant to Matter: + + * Device SDKs supporting ZigBee, Z-Wave, Matter, and Wi-Fi protocols + + * More than 80 device data model templates based on the AWS implementation of the Matter data model standard + + * Partner-built cloud-to-cloud (C2C) connectors + + * Unified device control across multiple brands and protocols + + * Available in Canada (Central), Europe (Ireland), and Middle East (UAE) regions + + + + +For more information, see [What is managed integrations for AWS IoT Device Management?](https://docs.aws.amazon.com/iot-mi/latest/devguide/what-is-managedintegrations.html) +