Clarification on Resource-Level Permissions and Tag-Based Access Control for ListWirelessDevices in AWS IoT Wireless

Hello,

As indicated in the Actions defined for IoT Wireless documentation [1], the action "ListWirelessDevices" does not have a value specified as the Resource element and the condition key as such, the resource element for the above-mentioned actions would need to be set as "*", and it does not support any condition key, meaning that it is possible for user, to only see either all the devices, or none of the devices via the AWS managament console.

[1] https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotwireless.html#awsiotwireless-actions-as-permissions

[2] https://docs.aws.amazon.com/iot-wireless/latest/developerguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-iot-wireless-resources

You cannot limit "ListWirelessDevices" action on the basis of tag as it does not support any condition key. However, you can limit other action listed in documentation [1] according to the supported condition key and resource for each action.

Hello, and thank you for your response.

I came across an alternative solution in another forum post with a similar question: How to list only the specified GW and Device. The suggestion there involves implementing a multi-account strategy within an AWS Organization. This approach would entail creating member AWS Accounts under the AWS Organization, allowing isolation of AWS resource visibility at the account level. This seems particularly useful for scenarios where users access AWS resources via the AWS Management Console, and where restrictive IAM policies might not provide the desired level of granularity.

Based on this, I have a follow-up question regarding the integration of AWS IoT Core for LoRaWAN gateways and devices across multiple accounts within the same AWS Organization:

If the gateways associated with AWS IoT Core for LoRaWAN are created and managed in one AWS account, and the devices are created and managed in another member account within the same AWS Organization, how is the device data handled? Specifically, is the device data received by the gateways routed to the member account that manages these devices, does it remain within the account that manages the gateways, or don't the devices connect at all?

Any insights or clarifications on this architecture and data flow would be greatly appreciated.

Thank you!