The A to Z of Internet of Things (AWS)
Tags: iot, tutorial, aws, beginners
Published: 2020-02-13 14:31:33

---
title: The A to Z of Internet of Things (AWS)
published: true
description: Join us as we go through the A to Z of IoT from an AWS perspective. We won't be using buzzwords or hand-waving, just talking about the awesome services and how they can be used more effectively.
canonical_url: https://devopstar.com/2020/02/12/the-a-to-z-of-internet-of-things-aws
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/a2edikk5m2e8vccwm6xa.jpg
tags: iot, tutorial, aws, beginners
---

*This post was originally written on [DevOpStar](https://devopstar.com/)*. Check it out [here](https://devopstar.com/2020/02/12/the-a-to-z-of-internet-of-things-aws)

**The IoT Community in 2020 is weird**.

There's a fair amount of hand waving and people talking about *doing* IoT but it's pretty hard to have a conversation with anyone about the specific services that under-pin the 3-letter acronym.

Because of this I would like to share my A-Z of IoT from the perspective of developing solutions on AWS. This guide doesn't include sections using the *buzzwords* you're probably a little tired of hearing about such as **Digital Twin** or **Edge**. Instead focuses on the **Services** & **Patterns** that take those buzzwords and turns them into reality.

> I'll be upfront, It's pretty hard to find an IoT service, let alone AWS ones to meet every single letter in the alphabet. This list serves more as a way to highlight some of the pieces that make up the IoT service offering right now, and also things to keep an eye on moving into the future.

---

#### 🇦 - **Alexa** Gadgets

---

When Amazon Alexa launched in 2014 as the first major home assistant platform I was captivated by the opportunities it offered someone like me. Clearly I wasn't alone either as over the coming years we saw a boom of new generation electronics incorporating virtual assistants in their sales pitch.

Now having voice assistant support is almost a must when launching any kind of home appliance, however this consumer demand is beginning to force hardware manufacturers to operate in a space that is very new and full of bad actors. Not all companies are technology first, so when their teams are asked to equip their white goods with internet capabilities there is a lot of room for error. **This is why I believe Amazon Alexa Gadgets are a really big deal**.

Gadgets convert an overly complex architecture to a simple bluetooth device removing a lot of technical junk that isn't required for the core functionality to deliver value for the end user.

![Alexa Gadget Architecture](https://dev-to-uploads.s3.amazonaws.com/i/dn0btgm8obiqcjsaedop.png)

##### Examples

* [Alexa Gadgets Introduction - Voice Controlled Cat Feeder](https://devopstar.com/2020/01/25/alexa-gadgets-introduction-voice-controlled-cat-feeder) - Making a Voice controlled cat feeder using Alexa Gadgets.

---

#### 🇧 - **Billing Groups**

---

[Billing Groups](https://docs.aws.amazon.com/iot/latest/developerguide/tagging-iot-billing-groups.html) within the context of IoT are very unique in AWS land. Typically you rely on billing under the account level, or optionally you can use tags and and [cost allocation tags](https://console.aws.amazon.com/billing/home?region=us-east-1#/preferences/tags) to better understand where cost is coming from.
 IoT service
The idea is that groups of devices can be tagged and then audited independently. This means that teams can be held accountable for their own budgets.

![AWS IoT Billing Groups](https://dev-to-uploads.s3.amazonaws.com/i/u3fo3q6utpw2wbu84x1d.png)

> **Note**: Billing groups within the context of a particular service is quite unique within AWS land. [I've pondered why AWS IoT](https://twitter.com/nathangloverAUS/status/1227220061737246720) is special enough to get it's own and figure it might be something to do with organizations preferring to group all their IoT devices in one account.

---

#### 🇨 - **Certificate** vending

---

If you've ever been through the process of setting up a new device with AWS IoT Core then you'll probably recall a sense of unease when creating new certificates for your devices.

I'm an advocate of allowing people to create and manage their own devices, however a set of guardrails are needed to ensure that a level of consistency is adhered to. Because of this I highly recommend looking into methods of performing certificate vending

Certificate vending is an automated process for generating X.509 certificates with correct roles and policies attached and handing these over to users safely.

![Certificate Vending machine architecture](https://dev-to-uploads.s3.amazonaws.com/i/4oxbma02xkigq3ef7027.png)

##### Examples

* [AWS IoT - Certificate Vending](https://devopstar.com/2019/09/07/aws-iot-certificate-vending) - Generating X.509 certificates automatically and attaching appropriate roles via an API gateway endpoint backed with DynamoDB.

---

#### 🇩 - Device Defender **Detect**

---

[Device Defender Detect](https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-detect.html) helps you identify abnormal behaviour by interpreting cloud-side and device-side metrics from your IoT Devices. Detect relies on an agent running on the device to publish metrics on network usage statistics. These statistics when paired with the cloud-side stats; can begin to paint a picture of the security of a given device.

![Device Defender Detect violation metrics](https://dev-to-uploads.s3.amazonaws.com/i/qcmaclntqibq0v8rowa6.png)

Some typical security incidents that Device Defender Detect might be able to report on are:

* Denial of Service attacks
* Participation in a Botnet
* Data exfiltration
* Incorrect device configuration
* Remote management ports open

##### Examples

* [Greengrass - Device Defender - Detect](https://devopstar.com/2019/11/24/greener-grass-device-defender-detect) - AWS IoT Device Defender provides a suite of options for Audit, Detection and Mitigation of IoT related security threats.

---

#### 🇪 - IoT **Enhanced** Custom Authorizer | ⭐ FAVOURITE ⭐

---

The [IoT Enhanced Custom Authorizer](https://docs.aws.amazon.com/iot/latest/developerguide/enhanced-custom-authentication.html) is a diamond in the rough. It's one of those services that solves a very difficult problem that's hard to articulate until you've been in a scenario where custom authorization for MQTT would be handy.

Currently this service is only in Beta in us-east-1 however I suspect as IoT adoption begins to increase, the need for this service to go GA will become more apparent.

I have a blog post planned on this topic coming soon, [definitely follow me on Twitter if you're interested](https://twitter.com/nathangloverAUS).

---

#### 🇫 - Amazon **FreeRTOS**

---

One fantastic thing with the IoT space is there's just so much variation in device chips that can be used. This does make deploying software to each device a bit of a pain when every chip does things slightly differently or has more / less functionality.

A solution to this problem was [FreeRTOS](https://www.freertos.org/) that provides common kernel for devices to build on. Amazon later began supporting its own version called [Amazon FreeRTOS](https://aws.amazon.com/freertos/) that helps you deploy embedded firmware that's *Cloud Ready*.

Amazon bundle and support common libraries that run on FreeRTOS such as WiFi, Bluetooth LE, MQTT and extend it to better integrate with [Greengrass](https://devopstar.com/category/blog/greengrass/) and other pieces of AWS Cloud.

---

#### 🇬 - **Greengrass** | ⭐ FAVOURITE ⭐

---

[AWS IoT Greengrass](https://aws.amazon.com/greengrass/) is a managed service that allows you to easily manage and communicate with edge devices. When you hear people talk about **Edge** devices, they probably mean something that will be running Greengrass eventually.

An Edge device is capable of handling incoming data from its surrounding sensors and then acuating, alerting, logging & responding to these metrics. Greengrass is the AWS service for managing this for you.

![Greengrass Edge Device](https://dev-to-uploads.s3.amazonaws.com/i/ps2vfbrbpnff22gt3prq.png)

Greengrass will also manage versions of Lambda & Secrets Manager at the edge for you, so if your teams already make use of serverless architectures it is very easy to move that logic to the edge.

Greengrass is my favourite AWS service for too many reasons, and I've blogged about it a lot in the past so I recommend checking those out!

##### Examples

* [Greengrass - Device Setup](https://devopstar.com/2019/11/24/greener-grass-device-setup) - Greengrass base setup using CDK.
* [Greengrass - Device Setup - Raspberry Pi](https://devopstar.com/2019/11/24/greener-grass-device-setup-raspberry-pi) - Greengrass specific setup for Raspberry Pi.
* [Greengrass - Docker Deployments](https://devopstar.com/2019/12/14/greener-grass-docker-deployments) - Using Greengrass Connectors for deploying docker configurations to the edge
* [Greengrass - Device Defender - Detect](https://devopstar.com/2019/11/24/greener-grass-device-defender-detect) - AWS IoT Device Defender provides a suite of options for Audit, Detection and Mitigation of IoT related security threats.
* [Greengrass - Secure Tunneling](https://devopstar.com/2019/12/25/greengrass-secure-tunneling) - AWS IoT Secure Tunneling is a managed proxy meant for devices positioned behind secure firewalls on remote sites.

---

#### 🇮 - **Industrial** IoT

---

I know I said I wouldn't use buzzwords, but Industrial IoT is a legitimate thing and there are solutions available in the AWS ecosystem to solve problems. I highly recommend this series of posts on [AWS IoT SiteWise](https://aws.amazon.com/iot-sitewise/) that uses an example of on OPC-UA server to ingest data streams from industrial systems.

* [Collecting, organizing, monitoring, and analyzing industrial data at scale using AWS IoT SiteWise (Part 1)](https://aws.amazon.com/blogs/iot/collecting-organizing-monitoring-and-analyzing-industrial-data-at-scale-using-aws-iot-sitewise-part-1/)
* [Collecting, organizing, monitoring, and analyzing industrial data at scale using AWS IoT SiteWise (Part 2)](https://aws.amazon.com/blogs/iot/collecting-organizing-monitoring-and-analyzing-industrial-data-at-scale-using-aws-iot-sitewise-part-2/)
* [Collecting, organizing, monitoring, and analyzing industrial data at scale using AWS IoT SiteWise (Part 3)](https://aws.amazon.com/blogs/iot/collecting-organizing-monitoring-and-analyzing-industrial-data-at-scale-using-aws-iot-sitewise-part-3/)

---

#### 🇯 - AWS IoT **Jobs**

---

[AWS IoT Jobs](https://docs.aws.amazon.com/iot/latest/developerguide/ios-sdk-create-job.html) help you deploy and manage tasks to be actioned by your fleet of IoT devices. Jobs underpin the Over the Air update service also mentioned later on in this list, however it is capable of executing any task you want on the IoT define.

![AWS IoT Jobs](https://dev-to-uploads.s3.amazonaws.com/i/p7ugpviaua1akr9q8qid.png)

> **Note**: Your device code needs to be setup to handle incoming job requests from the AWS defined topics below. For more information [check the developer guide](https://docs.aws.amazon.com/iot/latest/developerguide/jobs-devices.html)

```bash
$aws/things/MyThing/jobs/notify
$aws/things/MyThing/jobs/get/accepted
$aws/things/MyThing/jobs/get/rejected
$aws/things/MyThing/jobs/jobId/get/accepted
$aws/things/MyThing/jobs/jobId/get/rejected
```

---

#### 🇰 - **Kinesis** Streams

---

Although [Amazon Kinesis](https://aws.amazon.com/kinesis/) isn't technically part of the AWS IoT service, it is heavily used by teams using AWS IoT due to its ability to ingest enormous streams of data and make sense of it.

A very common architecture for IoT projects is to leverage with Kinesis Data Analytics and do real-time eventing based on the trends. [Below is an example architecture from AWS Solutions](https://aws.amazon.com/solutions/real-time-iot-device-monitoring-with-kinesis/).

![Kinesis Data Analytics architecture for AWS IoT](https://dev-to-uploads.s3.amazonaws.com/i/r6z2nvdggzr5h0cz2byu.png)

---

#### 🇱 - AWS IoT **Logging**

---

By default AWS IoT doesn't log anything! This is done intentionally, however if you're a regular user like me you'll want to enable it to give better visibility.

You can enable [AWS IoT Logging to CloudWatch](https://docs.aws.amazon.com/iot/latest/developerguide/cloud-watch-logs.html) by heading to the [Settings in the appropriate AWS IoT region](https://us-east-1.console.aws.amazon.com/iot/home?region=us-east-1#/settings).

![AWS IoT Setup Logging Role](https://dev-to-uploads.s3.amazonaws.com/i/alz62ucfkar7nkeo3uie.png)

Edit the `Logging` settings and create / specify a role with the following policy. **Note** *that the UI will step you through setting up this role automatically.*

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:PutMetricFilter",
        "logs:PutRetentionPolicy"
      ],
      "Resource": [
        "arn:aws:logs:*:123456789012:log-group:*:log-stream:*"
      ]
    }
  ]
}

... trust policy ...

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "iot.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

Now if you check CloudWatch under the log group called `AWSIotLogsV2` you should see log streams.

---

#### 🇲 - **MQTT**

---

[MQTT](http://mqtt.org/) is what underpins all communication by devices that use AWS IoT (or all IoT platforms for that matter). The IoT service that AWS provides is just an abstraction on top of the general architecture shown below.

![MQTT General Architecture](https://dev-to-uploads.s3.amazonaws.com/i/1h0r638sfni80wb20rep.png)

The AWS version of MQTT enables many of the traditional things you would expect from AWS services to be integrated nicely such as eventing based on rules, IAM authorization and logging. **Plus** its a fully managed broker for you at basically no cost.

---

#### 🇴 - **Over-the-Air** (OTA) Updates

---

Over-the-air (OTA) updates are crucial to get right, especially these days when patching a vulnerability or security flaw has to be done seamlessly.

[AWS IoT Over-the-air updates](https://docs.aws.amazon.com/freertos/latest/userguide/ota-console-workflow.html) leverage [AWS IoT Jobs](https://docs.aws.amazon.com/iot/latest/developerguide/iot-jobs.html) to deliver firmware or code updates to a device deployed in the field.

If you make use of AWS IoT Greengrass you would also be familiar that patches to Greengrass on devices are also done via an Over-the-air update (on top of IoT Jobs). Below is an example of how you could kick off a Greengrass core OTA update; the pattern is very similar for FreeRTOS OTA as well.

```bash
AWS_REGION="us-east-1"
ACCOUNT_ID=$(aws sts get-caller-identity | jq -r '.Account')

THING_NAME="thing_name"
THING_OS="raspbian" # ubuntu, amazon_linux, raspbian, openwrt
THING_ARCH="armv7l" # armv7l, armv6l, x86_64, aarch64
THING_SOFTWARE="core" # core, ota_agent

otaUpdateRole=$(aws cloudformation describe-stacks --stack-name greengrass-cdk \
  --query 'Stacks[0].Outputs[?OutputKey==`otaUpdateRole`].OutputValue' \
  --region ${AWS_REGION} \
  --output text)

aws greengrass create-software-update-job \
  --region ${AWS_REGION} \
  --update-targets-architecture ${THING_ARCH} \
  --update-targets arn:aws:iot:${AWS_REGION}:${ACCOUNT_ID}:thing/${THING_NAME} \
  --update-targets-operating-system ${THING_OS} \
  --software-to-update ${THING_SOFTWARE} \
  --update-agent-log-level DEBUG \
  --s3-url-signer-role ${otaUpdateRole}
```

---

#### 🇵 - **Policies**

---

Policies are the way permissions are assigned to devices using AWS IoT certificates. A policy document is much like [IAM](https://aws.amazon.com/iam/) policies in that it provides a set of permissions to do things with other AWS services

![AWS IoT Policy diagram](https://dev-to-uploads.s3.amazonaws.com/i/kr53khne04ut155r55ln.png)

An example of a policy statement can be seen below and will apply permissions allowing an IoT device to subscribe to topics with the name format `some/+/topic` where the `+` is a wildcard

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:123456789012:client/${iot:Connection.Thing.ThingName}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
          "iot:Subscribe"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:123456789012:topicfilter/some/+/topic"
      ]
    }
  ]
}
```

---

#### 🇷 - AWS **RoboMaker**

---

[AWS RoboMaker](https://aws.amazon.com/robomaker/) is a mostly managed service for deploying & running [ROS packages](https://www.ros.org/) to Robots. RoboMaker might appear niche at first glance however as the robotics industry expands, mechanisms to manage pushing software to devices in the field will be very important.

Not only does RoboMaker do ROS package deployments, but it will also do simulation for you by running managed [Gazebo](http://gazebosim.org/), [rqt](http://wiki.ros.org/rqt) & [rviz](http://wiki.ros.org/rviz) for you.

If you're a roboticist all of this should get you very excited!

##### Examples

* [AWS RoboMaker - Beginner's Guide to Robot Simulation](https://devopstar.com/2019/09/12/aws-robomaker-beginners-guide-to-robot-simulation) - Moderately good beginners guide to getting started with the entire RoboMaker suite
* [AWS RoboMaker - Raspberry Pi Bootstrap](https://devopstar.com/2019/10/27/aws-robomaker-raspberry-pi-bootstrap) - More beginner targeted with a focus on setting up ROS & RoboMaker on a Raspberry Pi.

---

#### 🇸 - Device **Shadow**

---

[Device Shadows](https://docs.aws.amazon.com/iot/latest/developerguide/iot-device-shadows.html) are often exaggerated to be called a **[Digital Twin](https://en.wikipedia.org/wiki/Digital_twin)**, however in reality its simply a mechanism to hold the state of a device.

The state is JSON formatted and can be read and wrote too by either the device or AWS IoT.

![Device Shadow](https://dev-to-uploads.s3.amazonaws.com/i/fvf6r6n5fyqs745jqh10.png)

##### Examples

* [AWS Sumerian Magic Cube](https://devopstar.com/2019/02/07/aws-sumerian-magic-cube) - Device Shadows are used in order to store the orientation state of a device, then display this data visually using [Amazon Sumerian](https://aws.amazon.com/sumerian/)

---

#### 🇹 - Secure **Tunneling** | ⭐ FAVOURITE ⭐

---

If you've ever deployed an IoT device to the field and had to perform an [OTA (Over-the-air update)](https://docs.aws.amazon.com/freertos/latest/userguide/ota-console-workflow.html) you will know the fear of breaking core parts of our hardware device through a bad firmware deploy.

Imagine if there was a service that could be always running and capable of getting you access back into the device! AWS Secure Tunneling is a service that runs a [localproxy](https://github.com/aws-samples/aws-iot-securetunneling-localproxy) and securely connects you back to your device.

![AWS IoT Secure Tunneling architecture](https://dev-to-uploads.s3.amazonaws.com/i/1f1hri1a7mzwaqru27gi.png)

##### Examples

* [Greengrass - Secure Tunneling](https://devopstar.com/2019/12/25/greengrass-secure-tunneling) - A definitive guide to using the AWS IoT Secure Tunneling service.

---

#### 🇻 - Computer **Vision**

---

Computer Vision is a very common pattern used on the Edge due to the bandwidth requirements and latency of streaming live video off to a remote location. You might be surprised to find that the [AWS DeepLens](https://aws.amazon.com/deeplens/) runs as a Greengrass core device in order to manage the models deployed to it at the edge.

If you are planning on doing an IoT project using video at the edge, I would highly recommend checking out the [ML Object Detection Connector for AWS IoT Greengrass](https://docs.aws.amazon.com/greengrass/latest/developerguide/obj-detection-connector.html).

![AWS IoT Greengrass running on DeepLens for Edge computer vision](https://dev-to-uploads.s3.amazonaws.com/i/64ftaeh5rlooqyanmow5.png)

---

#### 🇼 - **WebSockets**

---

[AWS IoT connections via MQTT can be provided over WebSockets as well as HTTPS](https://docs.aws.amazon.com/iot/latest/developerguide/mqtt-ws.html). allows for a lot more flexibility of use in places like web browsers.

The Amplify framework has fantastic support for these websocket style connections via the [MqttOverWSProvider](https://aws-amplify.github.io/docs/js/pubsub#third-party-mqtt-providers). This means your web applications can connect directly to AWS IoT topics and publish / subscribe data.

---

### Summary

---

Are you using AWS IoT, or doing something interesting with IoT in general? Well I'm very interested in hearing about it! Success or failure, please reach out to me on [Twitter @nathangloverAUS](https://twitter.com/nathangloverAUS) and start a discussion.