AWS iot-mi documentation change
Summary
Updated capitalization consistency ('Managed Integrations' instead of 'managed integrations'), added 'iotMiArrivalTimestamp' field to DEVICE_EVENT payload, clarified timestamp differences, and added new CONNECTOR_ERROR_REPORT event documentation.
Security assessment
The change adds documentation for the 'CONNECTOR_ERROR_REPORT' event which reports security-relevant errors like failed operations and authentication issues. The 'iotMiArrivalTimestamp' field enables security auditing by tracking event processing latency. However, no specific vulnerability fix is indicated.
Diff
diff --git a/iot-mi/latest/devguide/managedintegrations-notifications.md b/iot-mi/latest/devguide/managedintegrations-notifications.md index eb3b53557..f50ab2a92 100644 --- a//iot-mi/latest/devguide/managedintegrations-notifications.md +++ b//iot-mi/latest/devguide/managedintegrations-notifications.md @@ -7 +7 @@ -Set up Amazon Kinesis for notificationsSet up managed integrations notificationsEvent types monitored with managed integrations +Set up Amazon Kinesis for notificationsSet up Managed Integrations notificationsEvent types monitored with Managed Integrations @@ -9 +9 @@ Set up Amazon Kinesis for notificationsSet up managed integrations notifications -# Managed integrations notifications +# Managed Integrations notifications @@ -11 +11 @@ Set up Amazon Kinesis for notificationsSet up managed integrations notifications -Managed integrations notifications deliver updates and key insights from devices. Notifications include connector events, device commands, lifecycle events, OTA (Over-the-Air) updates, and error reports. These insights provide actionable information to create automated workflows, take immediate actions, or store event data for troubleshooting. +Managed Integrations notifications deliver updates and key insights from devices. Notifications include connector events, device commands, lifecycle events, OTA (Over-the-Air) updates, and error reports. These insights provide actionable information to create automated workflows, take immediate actions, or store event data for troubleshooting. @@ -13 +13 @@ Managed integrations notifications deliver updates and key insights from devices -Currently, only Amazon Kinesis data streams are supported as a destination for managed integrations notifications. You will first need to set up an Amazon Kinesis data stream and allow managed integrations access to the data stream before setting up notifications. +Currently, only Amazon Kinesis data streams are supported as a destination for managed integrations notifications. You will first need to set up an Amazon Kinesis data stream and allow Managed Integrations access to the data stream before setting up notifications. @@ -34 +34 @@ Currently, only Amazon Kinesis data streams are supported as a destination for m -To setup Amazon Kinesis for managed integrations notifications, follow these steps: +To setup Amazon Kinesis for Managed Integrations notifications, follow these steps: @@ -49 +49 @@ An Amazon Kinesis Data Stream can ingest a large amount of data in real time, du -Create a permissions policy that allows managed integrations to access your Kinesis data stream. +Create a permissions policy that allows Managed Integrations to access your Kinesis data stream. @@ -91 +91 @@ For more information, see [IAM role creation](https://docs.aws.amazon.com/IAM/la -You can use a custom trust policy to grant managed integrations access to the Kinesis data stream. +You can use a custom trust policy to grant Managed Integrations access to the Kinesis data stream. @@ -97 +97 @@ You can use a custom trust policy to grant managed integrations access to the Ki -The following policy allows managed integrations to assume the role, and the `Condition` statement helps prevent confused deputy issues. +The following policy allows Managed Integrations to assume the role, and the `Condition` statement helps prevent confused deputy issues. @@ -148 +148 @@ Add the permissions policy you created in step 2 to the role. -## Set up managed integrations notifications +## Set up Managed Integrations notifications @@ -161 +161 @@ Add the permissions policy you created in step 2 to the role. -To setup managed integrations notifications, follow these steps: +To setup Managed Integrations notifications, follow these steps: @@ -238 +238 @@ Lastly, use the [CreateNotificationConfiguration](https://docs.aws.amazon.com/io -## Event types monitored with managed integrations +## Event types monitored with Managed Integrations @@ -240 +240 @@ Lastly, use the [CreateNotificationConfiguration](https://docs.aws.amazon.com/io -The following are the event types monitored with managed integrations notifications: +The following are the event types monitored with Managed Integrations notifications: @@ -269 +269 @@ The following are the event types monitored with managed integrations notificati -The WebRTC standard allows communication between two peers. These peers can transmit real-time video, audio, and arbitrary data. Managed integrations supports WebRTC to enable these types of streaming between a customer mobile application and an end-user's device. For more information on the WebRTC standard, see [WebRTC](https://webrtc.org/). +The WebRTC standard allows communication between two peers. These peers can transmit real-time video, audio, and arbitrary data. Managed Integrations supports WebRTC to enable these types of streaming between a customer mobile application and an end-user's device. For more information on the WebRTC standard, see [WebRTC](https://webrtc.org/). @@ -330,0 +331 @@ The WebRTC standard allows communication between two peers. These peers can tran + "iotMiArrivalTimestamp":"2026-06-26T21:28:14.697Z", @@ -345,0 +347,8 @@ The WebRTC standard allows communication between two peers. These peers can tran +The `DEVICE_EVENT` payload contains the following fields: + + * `iotMiArrivalTimestamp`, String (ISO 8601): The timestamp indicating when the device event was published by the device into Managed Integrations. Use this field to determine the latency between when the event was generated by the device and when Managed Integrations received it. + + * `endpoints`: The list of device endpoints and their updated capability properties. + +The `timestamp` field in the outer message envelope indicates when the notification was delivered to Kinesis. The `iotMiArrivalTimestamp` in the payload indicates when the event arrived into Managed Integrations. These two timestamps can differ if there is processing latency between event arrival and the notification delivery. + @@ -535,0 +545,37 @@ Reflects changes in status of device life cycle (this includes onboarding status + * `CONNECTOR_ERROR_REPORT` + + * This notification is sent when a cloud-to-cloud (C2C) connector reports an error while processing a request on your behalf, such as a command or device discovery that returned a non-success response. + + { + "version": "1.0.0", + "messageId": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6", + "messageType": "CONNECTOR_ERROR_REPORT", + "source": "aws.iotmanagedintegrations", + "customerAccountId": "123456789012", + "timestamp": "2026-01-20T23:59:34.009284802Z", + "region": "ca-central-1", + "resources": [ + "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:account-association/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" + ], + "payload": { + "statusCode": 0, + "resourceType": "account-association", + "resourceId": [ + "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" + ], + "associationArn": [ + "arn:aws:iotmanagedintegrations:ca-central-1:123456789012:account-association/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" + ], + "connectorDestinationId": "b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7", + "connectorDeviceId": "connectorDeviceId11597664a", + "operation": "AWS.SendCommand", + "operationVersion": "1.0", + "traceId": "f4be7a5d55d34cc=_1", + "logLevel": "ERROR", + "message": "AWS.SendCommand operation failed during asynchronous invocation of the connector: Connector response exception: responseCode=xxx, responseMessage=Mocking a ValidationException with error code xxx", + "managedThingId": "c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8" + } + } + +The `managedThingId` field is included when it can be resolved for the request. Fields without a value are omitted from the payload. +