https://docs.aws.amazon.com/iot/latest/developerguide/device-shadow-document.html

At least $aws/things/+/shadow/update/documents topics should produce documents with "id" fields, but this is not documented anywhere.

Install the AWS IoT Device SDK for JavaScript

Second part:

cd ~/aws-iot-device-sdk-js-v2
npm install

npm install gives:

E404
Not Found - GET https://registry.npmjs.org/@convergencelabs/typedoc-plugin-cusom-modules/-/typedoc-plugin-custom-modules-0.4.0.tgz

'@convergence/[email protected]' is not in the npm registry.

etc...

trying to connection mqtt over websocket. using golang paho mqtt library.
The following policy in IAM role not working

        {
            "Effect": "Allow",
            "Action": [
                "iot:Publish"
            ],
            "Resource": [
                "arn:aws:iot:<REGION>:*******:topic/$aws/things/${iot:Connection.Thing.ThingName}/jobs/start-next",
                "arn:aws:iot:<REGION>:*******:topic/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*/update"
            ]
        }

but this policy works

        {
            "Effect": "Allow",
            "Action": [
                "iot:Publish"
            ],
            "Resource": [
                "arn:aws:iot:<REGION>:*******:topic/$aws/things/${iot:ClientId}/jobs/start-next",
                "arn:aws:iot:<REGION>:*******:topic/$aws/things/${iot:ClientId}/jobs/*/update"
            ]
        }

Those are not Iot core policy, those are IAM policy. these policies are attached to a role which has trusted relationship with credentials.iot.amazonaws.com to assume role.
Help is very much appreciated.

RT, just like the config guide for ddbv1 https://docs.aws.amazon.com/iot/latest/developerguide/iot-ddb-rule.html

When running the sample app using my iot endpoint,

node dist\index.js --topic topic_1 --root-ca %USERPROFILE%\certs\Amazon-root-CA-1.pem --cert %USERPROFILE%\certs\device.pem.crt --key %USERPROFILE%\certs\private.pem.key --endpoint your-iot-endpoint

I get an error as index.js cannot be found in _aws-iot-device-sdk-js-v2\samples\node\pub_sub\node_modules\aws-iot-device-sdk-v2\dist_. In fact, there is no dist folder in my install.

Under the documentation page:

https://docs.aws.amazon.com/iot/latest/developerguide/tagging-iot-iam.html

It says:
"Can't create a thing group the tag "env=prod" (in the example, see the line "aws:RequestTag/env" : "prod")."

It is missing 1 or more words for the sentence to be comprehensible.

Perhaps you meant to say "Can't create a thing group and set the tag "env=prod" within the API request?

Please correct the sentence accordingly, thank you.

Rename the default branch to the more inclusive branch name, "main"

Just ran into what seems to be a minor hiccup when setting up an AWS IoT rule. There is a value that I am evaluating and I need it to work this way

Case statements

If the value is

1. 0 then return 0
2. 1 then return 1
3. greater than 1 return 1
4. return null

something like this

case someval
WHEN 0 THEN 0
WHEN 1 THEN 1
WHEN (GREATER THAN 1) THEN 1
ELSE null

But I am not sure what would be the right way to do this. I am trying something like this but not very sure if that's right ... cos if you see in the I am again checking for a condition down the line. it may evaluate that condition then compare with someval. That wouldn't give the correct result.

case someval
WHEN 0 THEN 0
WHEN 1 THEN 1
WHEN (someval > 1) THEN 1
ELSE null

This should have been simpler but my SQL expertise is limited and in regular SQL I would have probably used an IIF (and immediate if or a ternary logic etc) or something

Hi all!

It would be really nice to make a setup guide for the Secure Tunneling setup for example for a ubuntu based IoT device.
It is really hard to understand all the necessary steps to setup a tunnel for a device.
I guest the most effective way if you use a a dedicated EC2 instance for it, like a bastion host in a standard cloud environment.
This "bastion" EC2 shall be reached vie the Session Manager, and inside that host you should initiate a secure tunnel to a specific IoT device.

It would super helpfull to guide us from what and how should be installed on both the EC2 "bastion" and the IoT thing (Greengrass Core device), how to handle and store the tunnel tokens.
I will be grateful if only the easier method (source or destination) published.

Thanks in advance!

Hi,

In the documentation page - https://github.com/awsdocs/aws-iot-docs/blob/master/developerguide/connect-iot-lorawan-configure-resource-logging.md

1. File prefix
   The below command expects prefix file://
   aws iotwireless update-log-levels-by-resource-types --cli-input-json Input.json

This is the command that worked,
aws iotwireless update-log-levels-by-resource-types --cli-input-json file://input.json

2. Json format error:

{
    "DefaultLogLevel": "INFO",
    "WirelessDeviceLogOptions": 
     [
        {
         "Type": "Sidewalk",
         "LogLevel": "INFO",
         "Events": 
          [
            {
              "Event": "Registration",
              "LogLevel": "DISABLED"
            }
          ]
        }, 
        {
         "Type": "LoRaWAN",
         "LogLevel": "INFO",
         "Events": 
          [
            {
             "Event": "Join",
             "LogLevel": "DISABLED"
            }, 
            {
             "Event": "Rejoin",
             "LogLevel": "ERROR"
            }
          ]
        }
      ]
     "WirelessGatewayLogOptions": 
      [
        {
         "Type": "LoRaWAN",
         "LogLevel": "INFO",
         "Events": 
          [
            {
             "Event": "CUPS_Request",
             "LogLevel": "DISABLED"
            }, 
            {
              "Event": "Certificate",
              "LogLevel": "ERROR"
            }
          ]
        }
      ]
}

This is the valid json. As WirelessDeviceLogOptions is an array, it was missing a comma

{
    "DefaultLogLevel": "INFO",
    "WirelessDeviceLogOptions": 
     [
        {
         "Type": "Sidewalk",
         "LogLevel": "INFO",
         "Events": 
          [
            {
              "Event": "Registration",
              "LogLevel": "ERROR"
            }
          ]
        }, 
        {
         "Type": "LoRaWAN",
         "LogLevel": "INFO",
         "Events": 
          [
            {
             "Event": "Join",
             "LogLevel": "ERROR"
            }, 
            {
             "Event": "Rejoin",
             "LogLevel": "ERROR"
            }
          ]
        }
      ],
     "WirelessGatewayLogOptions": 
      [
        {
         "Type": "LoRaWAN",
         "LogLevel": "INFO",
         "Events": 
          [
            {
             "Event": "CUPS_Request",
             "LogLevel": "ERROR"
            }, 
            {
              "Event": "Certificate",
              "LogLevel": "ERROR"
            }
          ]
        }
      ]
}

{
"version": 3,
"thingName": "MyLightBulb",
"defaultClientId": "MyLightBulb",
"thingTypeName": "LightBulb",
"attributes": {
"model": "123",
"wattage": "75"
}
}

See https://docs.aws.amazon.com/iot/latest/developerguide/secure-tunneling.html vs https://github.com/awsdocs/aws-iot-docs/blob/master/developerguide/secure-tunneling.md The two texts are different.

Specifically there is a typo in the former that has been corrected on the latter : "secure tunneling does not require" vs "Secure tunneling does not require" (capitalization at start of sentence) but there are many additional differences.

¯\_(ツ)_/¯

Hi,

I think it would be appropriate to point out that AWS IoT handles # differently than the specification linked in the section AWS IoT differences from MQTT version 3.1.1 specification.

The MQTT v3.1.1 specification specifies "The multi-level wildcard represents the parent and any number of child levels." The topic filter "sport/#" should match the topic "sport". That is not the case with AWS IoT which does not match the parent topic.

While the way AWS IoT handles # is documented in Topic filters I think this difference from specification is worth mentioning in a bullet point in the "Differences from MQTT" section.

I would be willing to write this addition and make a PR if you give me the go-ahead.

Hi AWS team,

Currently, client is using /update/delta to sync "reported" and "desired" document.
However, in case, a property of desired document become null, there is no message send to /update/delta.
Could you guide me how the client know a property of desired document become null?

Thanks,

One document says refreshAfterInSecs - https://github.com/awsdocs/aws-iot-docs/blame/master/developerguide/custom-authorizer.md#L29

Another document says refreshAfterInSeconds - https://github.com/awsdocs/aws-iot-docs/blame/master/developerguide/config-custom-auth.md#L60

Which is it?

We are a security research team and we recently discovered that there is an over-authorization security issue with this project's IoT policies.
The affected files are as following:

1. aws-iot-docs/developerguide/connect-iot-lorawan-create-destinations.md
2. aws-iot-docs/developerguide/iot-dc-install-provision.md
3. aws-iot-docs/developerguide/lightbulb-shadow-application.md
4. aws-iot-docs/developerguide/connect-policy.md

The documentation says that + and # wildcards are treated as literal values and that customers should use * wildcards.

https://github.com/awsdocs/aws-iot-docs/blame/7b216b17d6c51a45fba81ab566dc9bd7d46181ea/developerguide/pub-sub-policy.md#L228

However, immediately above this is an example of a topic filter with a + in it and it says:

For devices registered as things in the AWS IoT Core registry, the following policy grants permission to connect to AWS IoT Core with the client ID that matches the thing name, and to subscribe to the topic filter some/+/topic only:

Is this intended?