AWS IoT - An Access Control Model
Mathias Weber
Data Architect and Author of the Book "Other People's Software Endeavours"
Motivation
IoT becomes more relevant with each day. Therefore, it is also a topic for the hyperscalers like Microsoft Azure, AWS and Google Cloud Platform. The book I referenced during my last two articles proposes a formal Access Control model for AWS. This formal Access Control Model is helpful to get a better grasp on how Access Control is being realized in AWS. Here is the reference to the book:
Gupta, M., Bhatt, S., Alshehri, A. H., & Sandhu, R. S. (2022). Access Control Models and Architectures For IoT and Cyber Physical Systems.
AWS IoT Access Control Model - Overview
In the below picture you can see an excerpt (showing the part pertaining to the AWS IoT Service) of the formal access control model proposed by the authors:
Central to the Access Control model are the AWS IoT Service, which serves as a representation for the IoT service in AWS and as an owner for the IoT entities, and the Devices, which exist independent of AWS in the real (physical) world.
Binding the physical space to the AWS cloud
Devices in the physical space like sensors or actuators use certificates to authenticate to the AWS IoT Service. For this purpose the device needs to hold a valid certificate as well as its private key. Certificates are being issued by a certificate authority. Certificates can be generated by AWS IoT Service or the device client.
领英推荐
IoT Objects
IoT Objects exist within AWS. They act as a substitute for components of physical IoT devices. AWS IoT categorizes IoT objects into Thing objects and Thing Shadow (also known as Device Shadow) objects. Each physical device has to be associated with one Thing and one Thing Shadow in AWS. The Thing Shadow basically represents the last known (i.e. known to the AWS cloud) status of the IoT device. This allows other IoT devices and applications to interact through the Thing Shadow with the shadowed IoT device even if the device itself is offline.
IoT Operations
AWS offers four basic IoT operations making use of the MQTT protocol (a publish-subscribe network protocol):
For devices and clients using the HTTP(S) protocol the following operations are also available:
Rules and Actions
In AWS IoT rules can be defined. These rules are SQL statements and can trigger actions if certain conditions specified in a rule are met. To be able to perform actions a rule needs to be associated with an IAM (Identity and Access Management) role that allows for the actions to be performed. Actions can be performed on AWS IoT objects as well as on AWS services.
Conclusion
It is indeed very useful to have a formal model for Access Control in AWS (or any other hyperscaler) at hand. Even if the model is not fully accurate it can serve as a starting point for a further investigation. It can be adjusted (which will be required either way as Cloud services are constantly evolving) until it serves the desired use case.