Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Can a micro-controller be a "Trusted User" for fleet provisioning?

0

Is it possible for the ESP32 micro-controller to be the Trusted user upon bootstrap certificate Identity verification? This way, the micro-controller can send the phone the AWS credentials it created as the trusted user?

Some background: I am developing an IoT system of products with ESP32 micro-controllers and a mobile phone app for the user to use. I want to avoid at all costs having the user create an account to contact their IoT devices. Reading through the Trusted User and Lambda documentation, it mentions "One way to do this is to provide and maintain an account for the trusted user. " but it doesn't mention any other ways. I was planning on flashing a bootstrap certificate for production onto the ESP32s and using Fleet Provisioning through Trusted User to allow the micro-controller to transmit the necessary details to allow the phone to provision as well. This way the phone can communicate to the micro-controllers it is connected to remotely over AWS. I have a primary, local method to connect the phone to the OT devices, which will establish the first connection between the phone and the micro-controller to allow this communication to happen so this is not an issue to consider.

Topics
ServerlessInternet of Things (IoT)ComputeSecurity, Identity, & Compliance
Tags
AWS Identity and Access ManagementInternet of Things (IoT)IAM PoliciesSecurity, Identity, & ComplianceAWS Lambda
Language
English

asked a year ago204 views

2 Answers
0

Based on the AWS IoT Core fleet provisioning documentation, a microcontroller like the ESP32 is not intended to be the "trusted user" in the fleet provisioning by trusted user model.

In the fleet provisioning by trusted user approach, the trusted user is typically a human end user or installation technician who uses a mobile app or web service to initiate the provisioning process. The trusted user must be authenticated and have permissions to perform the provisioning operations.

For your use case with ESP32 microcontrollers, you have two main options:

  1. Fleet provisioning by claim: This would involve manufacturing your ESP32 devices with provisioning claim certificates and private keys embedded in them. These certificates would be registered with AWS IoT and can be exchanged for unique device certificates when the device connects to AWS IoT for the first time.

  2. Fleet provisioning by trusted user: In this case, your mobile app would act as the interface for the trusted user (the end user of your product). The mobile app would obtain temporary provisioning credentials and pass them to the ESP32 during the initial setup/Wi-Fi configuration.

For your goal of avoiding user account creation, you could implement the second approach where your mobile app handles the trusted user role without requiring the end user to create an AWS account. The app itself would be granted the necessary permissions to act as the trusted user through your backend services.

The ESP32 would not be the trusted user itself, but rather the recipient of the temporary credentials generated through the trusted user process initiated by the mobile app. Once the ESP32 receives these temporary credentials, it can connect to AWS IoT and exchange them for permanent device-specific credentials.
Sources
Provisioning devices that don't have device certificates using fleet provisioning - AWS IoT Core
Fleet provisioning layer - IoT Lens
Provisioning identity in AWS IoT Core for device connections - Device Manufacturing and Provisioning with X.509 Certificates in AWS IoT Core
Device provisioning - AWS IoT Core

answered a year ago

  • gtorres
    a year ago

    How would I go about getting the temporary provisioning credentials with my app, again the goal is preventing the user from having to make any kind of account or even interact with AWS directly at all. Additionally, how long would this temporary provision last? Is it possible for the app to request multiple in case the old one expires?

0

It is possible to use ESP32 (or any other device) to automate the initial onboarding process. There are several ways to implement that functionality.

One of the most commonly used solutions uses the Onboarding Certificate to initiate the connectivity with AWS IoT and obtain the Unique Certificate (dedicated for a given device). Then the ESP32 can send the Unique Certificate to the Mobile App. From that moment, the Mobie App can communicate directly with AWS IoT via MQTT using that certificate and the corresponding Private Key.

This is a high-level diagram that describes this solution:

onboarding

I am unsure about the Mobile App <-> OT communication based on the description you provided.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content