I am setting up an IoT device using this library (https://github.com/odelot/aws-mqtt-websockets) to connect to the AWS IoT service. I have it working and it works well, however, I have a bit of a question about the device's use of an AWS user's secret key.

In order to set up the library, you create an IAM user with only IoT permissions, then generate a key and secret and load that onto the IoT device. The IoT device then uses that information to connect through the library to the AWS IoT MQTT service.

I was always taught to NEVER put a secret key onto a client facing device. So, I am wondering

  1. Is this secure / how so?
  2. Do I need to create a new IAM user for every account?
  3. Is this common practice?
  4. Would a service such as Cognito be better?

Nope you don't put IAM User Access key and Secret key onto the end user device. Never. And you don't create IAM User for each IoT node either.

Instead each AWS IoT device will get its own IoT credential file (created as part of the device registration). Not the IAM keys but these IoT keys are what you upload to the device.

I believe there are 3 PEM files per device - certificate, private key and public key.

Hope that helps :)

| improve this answer | |
  • Thanks for the input. I looked around and found the correct solution burried in the weeds. Glad to know my instinct of NEVER putting in a private key is still good. In case anyone is looking for how to use certificates with an ESP8266, this github project has proven useful: github.com/copercini/esp8266-aws_iot – Reid Jan 24 '19 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.