Setting up AWS IoT Events
If you do not have an AWS account, complete the following steps to create one.
To sign up for an AWS account
Follow the online instructions.
Part of the sign-up procedure involves receiving a phone call and entering a verification code on the phone keypad.
When you sign up for an AWS account, an AWS account root user is created. The root user has access to all AWS services and resources in the account. As a security best practice, assign administrative access to an administrative user, and use only the root user to perform tasks that require root user access.
Setting up permissions for AWS IoT Events
This section describes the roles and permissions that are required to use some features of AWS IoT Events. You can use AWS CLI commands or the AWS Identity and Access Management (IAM) console to create roles and associated permission policies to access resources or perform certain functions in AWS IoT Events.
The IAM User Guide has more detailed information about securely controlling permissions to access AWS resources. For information specific to AWS IoT Events, see Actions, resources, and condition keys for AWS IoT Events.
To use the IAM console to create and manage roles and permissions, see IAM tutorial: Delegate access across AWS accounts using IAM roles.
Note
Keys can be 1-128 characters and can include:
-
uppercase or lowercase letters a-z
-
numbers 0-9
-
special characters -, _, or :.
Action permissions
AWS IoT Events enables you to trigger actions which use other AWS services. To do so, you must
grant AWS IoT Events permission to perform these actions on your behalf. This section contains a list
of the actions and an example policy which grants permission to perform all these actions on
your resources. Change the region
and
account-id
references as required. When possible, you should
also change the wildcards (*) to refer to specific resources that will be accessed. You can
use the IAM console to grant permission to AWS IoT Events to send an Amazon SNS alert that you have
defined.
.
AWS IoT Events supports the following actions that let you use a timer or set a variable:
-
setTimer to create a timer.
-
resetTimer to reset the timer.
-
clearTimer to delete the timer.
-
setVariable to create a variable.
AWS IoT Events supports the following actions that let you work with AWS services:
-
iotTopicPublish to publish a message on an MQTT topic.
-
iotEvents to send data to AWS IoT Events as an input value.
-
iotSiteWise to send data to an asset property in AWS IoT SiteWise.
-
dynamoDB to send data to an Amazon DynamoDB table.
-
dynamoDBv2 to send data to an Amazon DynamoDB table.
-
firehose to send data to an Amazon Kinesis Data Firehose stream.
-
lambda to invoke an AWS Lambda function.
-
sns to send data as a push notification.
-
sqs to send data to an Amazon SQS queue.
Example Policy
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iot:Publish", "Resource": "arn:aws:iot:
<region>
:<account_id>
:topic/*" }, { "Effect": "Allow", "Action": "iotevents:BatchPutMessage", "Resource": "arn:aws:iotevents:<region>
:<account_id>
:input/*" }, { "Effect": "Allow", "Action": "iotsitewise:BatchPutAssetPropertyValue", "Resource": "*" }, { "Effect": "Allow", "Action": "dynamodb:PutItem", "Resource": "arn:aws:dynamodb:<region>
:<account_id>
:table/*" }, { "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:<region>
:<account_id>
:deliverystream/*" }, { "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:<region>
:<account_id>
:function:*" }, { "Effect": "Allow", "Action": "sns:Publish", "Resource": "arn:aws:sns:<region>
:<account_id>
:*" }, { "Effect": "Allow", "Action": "sqs:SendMessage", "Resource": "arn:aws:sqs:<region>
:<account_id>
:*" } ] }
Securing input data
It's important to consider who can grant access to input data for use in a detector
model. If you have a user or entity whose overall permissions you want to restrict, but that
is permitted to create or update a detector model, you must also grant permission for that
user or entity to update input routing. This means that in addition to granting permission
for iotevents:CreateDetectorModel
and
iotevents:UpdateDetectorModel
, you must also grant permission for
iotevents:UpdateInputRouting
.
Example
The following policy adds permission for
iotevents:UpdateInputRouting
.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "updateRoutingPolicy", "Effect": "Allow", "Action": [ "iotevents:UpdateInputRouting" ], "Resource": "*" } ] }
You can specify a list of input Amazon Resource Names (ARNs) instead of the wildcard
"*
" for the "Resource
" to limit this permission to specific
inputs. This enables you to restrict access to the input data that is consumed by detector
models created or updated by the user or entity.
Amazon CloudWatch logging role policy
The following policy documents provide the role policy and trust policy that allow AWS IoT Events to submit logs to CloudWatch on your behalf.
Role policy:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:PutMetricFilter", "logs:PutRetentionPolicy", "logs:GetLogEvents", "logs:DeleteLogStream" ], "Resource": [ "arn:aws:logs:*:*:*" ] } ] }
Trust policy:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "iotevents.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] }
You also need an IAM permissions policy attached to the user that allows the user to pass roles, as follows. For more information, see Granting a user permissions to pass a role to an AWS service in the IAM User Guide.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Action": [ "iam:GetRole", "iam:PassRole" ], "Resource": "arn:aws:iam::
<account-id>
:role/Role_To_Pass" } ] }
You can use the following command to put the resource policy for CloudWatch logs. This allows AWS IoT Events to put log events into CloudWatch streams.
aws logs put-resource-policy --policy-name ioteventsLoggingPolicy --policy-document "{ \"Version\": \"2012-10-17\", \"Statement\": [ { \"Sid\": \"IoTEventsToCloudWatchLogs\", \"Effect\": \"Allow\", \"Principal\": { \"Service\": [ \"iotevents.amazonaws.com\" ] }, \"Action\":\"logs:PutLogEvents\", \"Resource\": \"*\" } ] }"
Use the following command to put logging options. Replace the roleArn
with
the logging role that you created.
aws iotevents put-logging-options --cli-input-json "{ \"loggingOptions\": {\"roleArn\": \"arn:aws:iam::123456789012:role/testLoggingRole\", \"level\": \"INFO\", \"enabled\": true } }"
Amazon SNS messaging role policy
The following policy documents provide the role policy and trust policy that allow AWS IoT Events to send SNS messages.
Role policy:
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "sns:*" ], "Effect": "Allow", "Resource": "
arn:aws:sns:us-east-1:123456789012:testAction
" } ] }
Trust policy:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": [ "iotevents.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] }