Python code for IoT fleet style registration

0

I already found the docs at https://docs.aws.amazon.com/iot/latest/developerguide/fleet-provision-api.html

but I would feel better if I could find some known good working code out there.

It sounds fairly easy, to publish to $aws/certificates/create/json and then $aws/provisioning-templates/templateName/provision/json

but i'd still feel better with known working python code to start with as a base.

I'm aiming for code being called with a cred file from a user specifically just for provisioning.

asked 10 months ago219 views
4 Answers
2

Hi, the AWS IoT Device Management workshop has an example for fleet provisioning in Python. When you launch the workshop environment you can try it out.

Cheers,
Philipp

AWS
EXPERT
answered 10 months ago
  • Its missing code.

    "a role is required that grants permission to access the input file. This role has been already created by CloudFormation and the name of the role has been copied during the setup of the workshop to the shell variable $ARN_IOT_PROVISIONING_ROLE."

1
answered 10 months ago
  • Hmm. actually, thats a lot of code in there. The README could use more explanations.. Which part is the (set up a new IoT thing) ?

  • We added creatething.py . Hopefully this trivial sample code will enable you to add the rest of the code you need according to your unique requirements. Otherwise, please contact AWS Support.

0

Thank you both for your replies.

As an addendum, i discovered I can do ALMOST everything I needed from the aws CLI.

But instead of creating an X.509 cert for a provisioning cert.. I can use the exact same method for creating X.509s for a new "thing", if I start with a provisioning user in my config.

Basically,

aws iot create-thing --thing-name $THINGNAME
aws iot create-keys-and-certificate .....
aws iot attach-thing-principal --thing-name $THINGNAME  \
 --principal $CERT_ARN

But, the only drawback with this method is... I have no way to auto-bounce the creation if the thing-name already exists. For security reasons, the cloud needs to reject it. It is not enough for the script above to do a check for pre-existance first.

answered 10 months ago
0
answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions