Security - Disaster Recovery for AWS IoT

Security

When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This shared model reduces your operational burden because AWS operates, manages, and controls the components including the host operating system, the virtualization layer, and the physical security of the facilities in which the services operate. For more information about AWS security, visit the AWS Security Center.

IAM roles

AWS Identity and Access Management (IAM) roles allows you to assign granular access policies and permissions to services and users on the AWS Cloud. This solution creates IAM roles that grant the solution’s AWS Lambda functions access to create Regional resources.

You can find the IAM roles and policies in the CloudFormation templates that are used to deploy the solution.

Additional IAM roles

The following IAM roles are not created by CloudFormation templates. They are example roles that can be customized to your need.

IAM role AWS Fargate

The following role is used to run the region-to-region sync on AWS Fargate.

Trust relationship:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }

Policy:

{ "Action": [ "dynamodb:DeleteItem", "dynamodb:DescribeTable", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:UpdateItem" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:*" }, { "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPolicy", "iot:AttachThingPrincipal", "iot:CreateDynamicThingGroup", "iot:CreatePolicy", "iot:CreateThing", "iot:CreateThingGroup", "iot:CreateThingType", "iot:DeleteCertificate", "iot:DeleteDynamicThingGroup", "iot:DeletePolicy", "iot:DeleteThing", "iot:DeleteThingGroup", "iot:DeleteThingType", "iot:DeprecateThingType", "iot:DescribeCertificate", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:DescribeThingType", "iot:DetachPolicy", "iot:DetachThingPrincipal", "iot:GetIndexingConfiguration", "iot:GetPolicy", "iot:ListAttachedPolicies", "iot:ListPrincipalPolicies", "iot:ListPrincipalThings", "iot:ListThingGroupsForThing", "iot:ListThingPrincipals", "iot:ListThings", "iot:ListThingTypes", "iot:ListThingsInThingGroup", "iot:RegisterCertificateWithoutCA", "iot:RemoveThingFromThingGroup", "iot:SearchIndex", "iot:UpdateCertificate", "iot:UpdateThing", "iot:UpdateThingGroup", "iot:UpdateThingShadow" ], "Resource": "*" }

IAM role for Jupyter notebooks

The Jupyter notebooks provided with the solution call APIs from AWS IoT and AWS Certificate Manager private CA. To allows access to your IoT, use the following permissions for the environment where you run the notebooks.

{ "Effect": "Allow", "Action": [ "acm-pca:*", "iot:*" ], "Resource": "*" }