AWS IOT 构造库

本单元中更高层次的构件的API是实验性的并正在积极开发中. 在今后任何版本中,它们都须作非背向相容的修改或去除。 这些是 不适用 语义版本 模型和断开的更改 在发行笔记中宣布. 这意味着虽然你可能使用它们,但可能需要更新 当更新到此软件包的更新版本时,您的源代码.

AWS IOT Core允许您连接数十亿个IOT设备以及数以万亿计的路由 向AWS服务发送信息而不管理基础设施.

TopicRule

创建一个主题规则,使您的设备能够与 AWS 服务交互. 您可以以下列动作创建主题规则:

const func = new lambda.Function(this, 'MyFunction', {
  runtime: lambda.Runtime.NODEJS_LATEST,
  handler: 'index.handler',
  code: lambda.Code.fromInline(`
    exports.handler = (event) => {
      console.log("It is test for lambda action of AWS IoT Rule.", event);
    };`
  ),
});

new iot.TopicRule(this, 'TopicRule', {
  topicRuleName: 'MyTopicRule', // optional
  description: 'invokes the lambda function', // optional
  sql: iot.IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
  actions: [new actions.LambdaFunctionAction(func)],
});

或者,你可以在构建后添加一个动作 TopicRule 实例如下:

declare const func: lambda.Function;

const topicRule = new iot.TopicRule(this, 'TopicRule', {
  sql: iot.IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
});
topicRule.addAction(new actions.LambdaFunctionAction(func));

您也可以提供 errorAction 如下, 如果规则的行为无法执行,则IOT规则将触发:

import * as logs from 'aws-cdk-lib/aws-logs';

const logGroup = new logs.LogGroup(this, 'MyLogGroup');

new iot.TopicRule(this, 'TopicRule', {
  sql: iot.IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
  errorAction: new actions.CloudWatchLogsAction(logGroup),
});

如果你想让主题规则禁用, 请添加属性 enabled: false 现改为:

new iot.TopicRule(this, 'TopicRule', {
  sql: iot.IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
  enabled: false,
});

另见 @aws-cdk/aws-iot-actions-alpha (英语) 用于其他行动.

日志

AWS IOT提供 日志特性 允许您监视和记录 AWS IOT 活动.

您可以使用以下代码启用 IOT 日志 :

new iot.Logging(this, 'Logging', {
  logLevel: iot.LogLevel.INFO,
});

说明: 所有日志已转发至 AWSIotLogsV2 云表的日志组.

审计

一个 AWS IOT 设备维护者审计外观 与账户和装置有关的设置和政策已经到位,以确保安全措施. 审计可以帮助你发现任何偏离安全最佳做法或准入政策的情况.

账户审计配置

信息技术审计包括: 各种审计检查,并且需要配置设置以允许这些检查.

您可以启用以下代码的账户审计配置 :

// Audit notification are sent to the SNS topic
declare const targetTopic: sns.ITopic;

new iot.AccountAuditConfiguration(this, 'AuditConfiguration', {
  targetTopic,
});

默认情况下,所有审计检查都是启用的,但也有可能只允许特定的审计检查.

new iot.AccountAuditConfiguration(this, 'AuditConfiguration', {
  checkConfiguration: {
    // enabled
    authenticatedCognitoRoleOverlyPermissiveCheck: true,
    // enabled by default
    caCertificateExpiringCheck: undefined,
    // disabled
    caCertificateKeyQualityCheck: false,
    conflictingClientIdsCheck: false,
    deviceCertificateAgeCheck: false,
    deviceCertificateExpiringCheck: false,
    deviceCertificateKeyQualityCheck: false,
    deviceCertificateSharedCheck: false,
    intermediateCaRevokedForActiveDeviceCertificatesCheck: false,
    ioTPolicyPotentialMisConfigurationCheck: false,
    iotPolicyOverlyPermissiveCheck: false,
    iotRoleAliasAllowsAccessToUnusedServicesCheck: false,
    iotRoleAliasOverlyPermissiveCheck: false,
    loggingDisabledCheck: false,
    revokedCaCertificateStillActiveCheck: false,
    revokedDeviceCertificateStillActiveCheck: false,
    unauthenticatedCognitoRoleOverlyPermissiveCheck: false,
  },
});

要配置 设备证书年龄检查,您可以指定检查的持续时间 :

import { Duration } from 'aws-cdk-lib';

new iot.AccountAuditConfiguration(this, 'AuditConfiguration', {
  checkConfiguration: {
    deviceCertificateAgeCheck: true,
    // The default value is 365 days
    // Valid values range from 30 days (minimum) to 3650 days (10 years, maximum)
    deviceCertificateAgeCheckDuration: Duration.days(365),
  },
});

排定的审计

您可以创建 预定审计 在指定的时间间隔内运行。 必须通过创建来启用您的账户检查 AccountAuditConfiguration。 。 。 .

declare const config: iot.AccountAuditConfiguration;

// Daily audit
const dailyAudit = new iot.ScheduledAudit(this, 'DailyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.DAILY,
  auditChecks: [
    iot.AuditCheck.AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK,
  ],
})

// Weekly audit
const weeklyAudit = new iot.ScheduledAudit(this, 'WeeklyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.WEEKLY,
  dayOfWeek: iot.DayOfWeek.SUNDAY,
  auditChecks: [
    iot.AuditCheck.CA_CERTIFICATE_EXPIRING_CHECK,
  ],
});

// Monthly audit
const monthlyAudit = new iot.ScheduledAudit(this, 'MonthlyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.MONTHLY,
  dayOfMonth: iot.DayOfMonth.of(1),
  auditChecks: [
    iot.AuditCheck.CA_CERTIFICATE_KEY_QUALITY_CHECK,
  ],
});