AWS guidance documentation change
Summary
Major restructuring of the Connected Mobility on AWS architecture documentation. Changed from a layered architecture description to a stack-based, phased deployment approach with detailed component breakdowns, deployment phases, and data flows.
Security assessment
The changes are primarily architectural and organizational, focusing on deployment methodology, component details, and data flow descriptions. While security features like X.509 certificates, IAM authentication, and VPC isolation are mentioned, these are part of the standard architecture description rather than new security documentation or fixes for specific vulnerabilities. No evidence of addressing a specific security incident or vulnerability.
Diff
diff --git a/guidance/latest/connected-mobility-on-aws/architecture-overview.md b/guidance/latest/connected-mobility-on-aws/architecture-overview.md index eaa059b2c..3db508fe9 100644 --- a//guidance/latest/connected-mobility-on-aws/architecture-overview.md +++ b//guidance/latest/connected-mobility-on-aws/architecture-overview.md @@ -1 +1 @@ -[Documentation](/index.html)[Guidance for Connected Mobility on AWS](https://aws.amazon.com/solutions/guidance/connected-mobility-on-aws/)[Implementation Guide](guidance-overview.html) +[Documentation](/index.html)[Guidance for Connected Mobility on AWS](https://aws.amazon.com/solutions/guidance/connected-mobility-on-aws/)[Implementation Guide](solution-overview.html) @@ -3 +3 @@ -Architecture diagram +Solution architecture @@ -7 +7 @@ Architecture diagram -The Guidance for Connected Mobility on AWS implements a modern, event-driven architecture designed for automotive-scale data processing. Built on AWS managed services, the guidance demonstrates enterprise best practices for handling millions of vehicle telemetry messages per second while maintaining sub-second processing latency. +This section provides a high-level description of the guidance architecture, including the six integrated stacks that comprise the guidance. The architecture uses [AWS Cloud Development Kit (AWS CDK)](https://aws.amazon.com/cdk/) for infrastructure deployment with a phase-based approach that ensures proper dependency management and efficient deployment. @@ -9 +9 @@ The Guidance for Connected Mobility on AWS implements a modern, event-driven arc -The architecture is organized into distinct layers that work together to provide end-to-end connected vehicle capabilities: +The solution provides a modern, scalable telemetry architecture designed to handle high-volume, real-time data streams from connected vehicle fleets. Each installation follows the same core architecture with six foundational stacks that can be customized to meet specific requirements. @@ -11 +11 @@ The architecture is organized into distinct layers that work together to provide -**Connectivity Layer** \- Secure vehicle-to-cloud communication using AWS IoT Core with mutual TLS authentication and X.509 certificates. Supports MQTT protocol for efficient, bidirectional messaging at automotive scale. +## Solution architecture @@ -13 +13 @@ The architecture is organized into distinct layers that work together to provide -**Ingestion Layer** \- High-throughput message streaming using Amazon MSK (managed Apache Kafka) with SCRAM authentication. Provides durable, ordered message delivery with multi-AZ replication for reliability. +Deploying this solution with the default parameters creates the following architecture in your AWS account. @@ -15 +15 @@ The architecture is organized into distinct layers that work together to provide -**Processing Layer** \- Real-time stream processing using Apache Flink on Amazon Kinesis Data Analytics. Performs stateful computations including trip aggregation, safety event detection, and predictive maintenance analysis. + @@ -17 +17 @@ The architecture is organized into distinct layers that work together to provide -**Storage Layer** \- Dual-purpose data storage with DynamoDB for operational queries (single-digit millisecond latency) and S3 for analytical workloads and long-term archival. +###### Note @@ -19 +19 @@ The architecture is organized into distinct layers that work together to provide -**Application Layer** \- Fleet management dashboard built with React and CloudScape Design System, delivered globally via CloudFront with Cognito authentication. +CloudFormation resources are created from [AWS Cloud Development Kit (AWS CDK)](https://aws.amazon.com/cdk/) constructs. @@ -21 +21 @@ The architecture is organized into distinct layers that work together to provide -The guidance uses a phase-based deployment approach, allowing organizations to start with basic fleet management capabilities (Phase 1-2) and progressively add real-time telemetry processing (Phase 3-6) as their connected vehicle program matures. This incremental approach reduces initial complexity, accelerates time-to-value, and allows teams to build operational expertise before scaling to full production workloads. +The solution architecture consists of six integrated stacks deployed in phases: @@ -23 +23 @@ The guidance uses a phase-based deployment approach, allowing organizations to s -## Architecture diagram + 1. **InfrastructureStack** – Provides the foundational networking and caching infrastructure including Amazon VPC with public and private subnets, NAT Gateway for secure internet access, and Amazon ElastiCache for Redis to maintain real-time vehicle state for sub-second lookups. @@ -25 +25 @@ The guidance uses a phase-based deployment approach, allowing organizations to s -The following diagram illustrates the complete Connected Mobility guidance architecture, showing all components and data flows from vehicle ingestion through processing to storage and user interface. + 2. **StorageStack** – Deploys Amazon DynamoDB tables for vehicles, trips, alerts, drivers, commands, geofences, and signal catalog with on-demand billing and point-in-time recovery enabled. Also provisions Amazon S3 buckets for telemetry data archival and web application assets. @@ -27 +27 @@ The following diagram illustrates the complete Connected Mobility guidance archi - + 3. **MSKStack** – Creates an Amazon MSK (Managed Streaming for Apache Kafka) cluster with three brokers for high-throughput telemetry data streaming. The cluster is deployed in the VPC with appropriate security groups and includes topics for telemetry, trips, alerts, FleetWise telemetry, and OEM telemetry. @@ -29 +29 @@ The following diagram illustrates the complete Connected Mobility guidance archi -**Key Data Flows** : + 4. **IoTStack** – Configures AWS IoT Core for vehicle connectivity including thing types, IoT policies, and certificate management. This stack handles fleet management operations and device provisioning. @@ -31 +31 @@ The following diagram illustrates the complete Connected Mobility guidance archi - 1. **Telemetry Ingestion** : Vehicles and simulator publish compressed telemetry to IoT Core using Basic Ingest (zero messaging cost) + 5. **TelemetryIntegrationStack** – Establishes the connection between AWS IoT Core and Amazon MSK through IoT Rules and VPC Destinations, enabling real-time telemetry data flow from vehicles to the streaming platform. @@ -33 +33 @@ The following diagram illustrates the complete Connected Mobility guidance archi - 2. **Message Routing** : IoT Rule decompresses payloads and routes to MSK via VPC destination using SCRAM authentication + 6. **FlinkStack** – Deploys Amazon Kinesis Data Analytics for Apache Flink applications that process streaming telemetry data in real-time. Ten applications handle telemetry preprocessing, trip detection, safety events, maintenance alerts, FleetWise protobuf decoding, campaign synchronization, geofence evaluation, and OEM telemetry transformation. CloudWatch alarms monitor processor health and idle processing. @@ -35 +35 @@ The following diagram illustrates the complete Connected Mobility guidance archi - 3. **Stream Processing** : Five Flink applications consume from Kafka topics using IAM authentication and process telemetry in parallel + 7. **UIStack** – Provides the Fleet Manager web application through Amazon CloudFront and Amazon S3, with backend APIs via Amazon API Gateway and AWS Lambda. Includes Amazon Cognito for user authentication and Amazon Location Service for real-time vehicle tracking and mapping capabilities. @@ -37 +37 @@ The following diagram illustrates the complete Connected Mobility guidance archi - 4. **Data Storage** : Processed data written to DynamoDB (structured), S3 (archive), and Redis (real-time cache) + 8. **CommandsStack** – Enables bidirectional communication with vehicles through remote commands sent via IoT Core MQTT. Includes command catalog derived from the signal catalog, command status tracking with latency measurement, and geofence management APIs. @@ -39 +39 @@ The following diagram illustrates the complete Connected Mobility guidance archi - 5. **User Access** : Fleet managers access UI via CloudFront, which calls API Gateway and Lambda to retrieve data from storage layers + 9. **SimulationStack** – Deploys cloud-based simulation infrastructure including Lambda functions for running fleet simulations without a local environment. Supports both MQTT Direct and FleetWise Edge simulation modes. @@ -41 +41 @@ The following diagram illustrates the complete Connected Mobility guidance archi - 6. **Observability** : CloudWatch captures logs and metrics from all services; Aurora stores IoT lifecycle events + 10. **FleetWiseStack** – Deploys AWS IoT FleetWise resources including signal catalogs, decoder manifests, and campaign management infrastructure for FleetWise Edge Agent integration. @@ -46 +46 @@ The following diagram illustrates the complete Connected Mobility guidance archi -**Security Boundaries** : +### Deployment flow @@ -48 +48 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * VPC isolation for MSK and Flink with private subnets +The solution uses a phase-based deployment approach to manage dependencies between stacks: @@ -50 +50 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * SCRAM authentication for IoT Core to MSK +**Phase 1: Foundation (Storage + IoT + UI)** – Deploys DynamoDB tables, IoT Core infrastructure, Fleet Manager UI (Lambda, Cognito, CloudFront, API Gateway, Location Service). Duration: 5-8 minutes. @@ -52 +52 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * IAM authentication for Flink to MSK +**Phase 2: Data Seeding (optional)** – Seeds historical demo data (30 days of trips). Duration: 2-3 minutes. @@ -54 +54 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * Cognito user pools for UI authentication +**Phase 3: Networking + Streaming (VPC + MSK + Redis)** – Creates VPC, NAT Gateway, ElastiCache for Redis, and MSK Kafka cluster. Duration: 8-12 minutes. @@ -56 +56 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * KMS encryption for data at rest +**Phase 3b: Telemetry Integration** – Connects IoT Core to MSK via IoT Rules and VPC Destinations. Duration: 10-15 minutes. @@ -57,0 +58 @@ The following diagram illustrates the complete Connected Mobility guidance archi +**Phase 4: FleetWise Integration** – Deploys FleetWise IoT Rules, VPC endpoints, and CampaignSyncProcessor configuration. Duration: 3-5 minutes. @@ -58,0 +60 @@ The following diagram illustrates the complete Connected Mobility guidance archi +**Phase 5: Stream Processing (Flink)** – Builds the Flink JAR and deploys all 10 Flink applications. Duration: 5-7 minutes. @@ -59,0 +62 @@ The following diagram illustrates the complete Connected Mobility guidance archi +**Phase 6: Data Seeding** – Seeds the decoder manifest, default campaign, signal catalog, and event catalog into DynamoDB. Duration: 2-3 minutes. @@ -61 +64 @@ The following diagram illustrates the complete Connected Mobility guidance archi -**Scalability Points** : +**Phase 7: Pipeline Configuration** – Configures MSK bootstrap servers and IAM authentication for Flink applications. Duration: 3-5 minutes. @@ -63 +66 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * MSK: Add brokers and partitions for higher throughput +**Phase 8: Cloud Simulation** – Deploys the ECS Fargate simulation infrastructure (cluster, task definitions, Lambda orchestrator). Duration: 3-5 minutes. @@ -65 +68 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * Flink: Increase parallelism (KPUs) for processing capacity +**Phase 9: Remote Commands** – Deploys the Commands Lambda, Command Response Handler, and IoT Rules for bidirectional vehicle communication. Duration: 2-3 minutes. @@ -67 +70 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * DynamoDB: Auto-scaling for read/write capacity +Total deployment time: 45-65 minutes. @@ -69 +72 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * Redis: Cluster mode for distributed caching +### Data flow @@ -71 +74 @@ The following diagram illustrates the complete Connected Mobility guidance archi - * CloudFront: Global edge caching for UI performance +The solution implements an integrated telemetry pipeline: @@ -72,0 +76 @@ The following diagram illustrates the complete Connected Mobility guidance archi + 1. **Vehicle Connectivity** – Vehicles connect securely to AWS IoT Core using X.509 certificates and MQTT protocol. In FleetWise Edge mode, the FWE agent handles connectivity, authentication, and campaign-driven signal collection from the vehicle CAN bus. @@ -73,0 +78 @@ The following diagram illustrates the complete Connected Mobility guidance archi + 2. **Data Ingestion** – Telemetry data flows through IoT Rules to Amazon MSK for high-throughput processing. MQTT Direct telemetry lands on the `cms-telemetry` topic. FleetWise Edge protobuf telemetry lands on the `fw-telemetry-raw` topic and is decoded by the FWTelemetryProcessor before joining the standard pipeline. @@ -74,0 +80,35 @@ The following diagram illustrates the complete Connected Mobility guidance archi + 3. **Campaign Management** – In FleetWise Edge mode, the CampaignSyncProcessor monitors agent checkins on the `fw-checkin` topic, resolves active campaigns from DynamoDB, and pushes decoder manifests and collection schemes to the edge agent through IoT Core MQTT. + + 4. **Real-time Processing** – Apache Flink applications on Amazon Kinesis Data Analytics process streams to generate trips, detect safety events, create maintenance alerts, and evaluate geofence boundaries. + + 5. **Remote Commands** – The CommandsStack enables bidirectional vehicle communication. Commands are sent from the Fleet Manager UI through API Gateway and Lambda, published to IoT Core MQTT, and tracked in DynamoDB with status updates and latency measurement. The command catalog is derived from actuatable signals in the signal catalog. + + 6. **Geofence Evaluation** – The GeofenceProcessor Flink application evaluates vehicle positions against active geofences in real-time, generating safety events when vehicles cross geofence boundaries. + + 7. **Data Storage** – Processed data is stored in DynamoDB with automatic scaling and backup. + + 8. **Real-time State** – Amazon ElastiCache for Redis maintains the last known vehicle state for sub-second lookups. + + 9. **Location Services** – Amazon Location Service provides maps, geocoding, and route calculation for vehicle tracking. + + 10. **Fleet Management** – The web application provides comprehensive fleet management, driver tracking, remote commands, geofence management, and analytics dashboards with real-time map visualization. + + + + +### Networking architecture + +The solution uses a single Amazon VPC with the following configuration: + + * **Public Subnets** – Host NAT Gateway for outbound internet access + + * **Private Subnets** – Host MSK cluster and ElastiCache for security + + * **Security Groups** – Restrict traffic between components following least-privilege principles + + * **VPC Endpoints** – Enable private connectivity to AWS services where applicable + + + + +The networking architecture supports both public internet access and private network configurations through VPC peering or AWS Transit Gateway. @@ -82 +122 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Concepts and definitions +Cost @@ -84 +124 @@ Concepts and definitions -Architecture diagram +Platform components