AWS IoT Core Integration with Google Cloud Function with HTTP Rule Action

Question

I have created a simple Google Cloud Function with HTTP Trigger and have given necessary permissions to listen to outside requests.

I'm using MQTT test client for Publishing a topic, ( as of now I do not have device registered in IoT Core) under a specific topic name. What I'm trying to achieve here is republish this message with help of Rules Engine.

So I first create a Rule with HTTP endpoint as the action for IoT Rule and attach all the policies and provide required permissions for this rule. The HTTP endpoint is the URL of the Google Cloud Function mentioned above. I have confirmed and activated the endpoint with the token that is sent by AWS to GCFunction.

I have generated an authentication token from GCFunction which is required by AWS for accessing the resource and saved it in the IoT Rule under Headers as 'Authorization: Bearer[$token]'.

Expected Result: When I publish a message from the test client, it should show the message in the logs of GCFunction.

Actual Result: I see 403 and 401 errors. Stating the request is not authorized to invoke this service.

I think everything from the GCFunction end is fine since I tested it with Postman and got the expected result. But doesn't work with AWS IoT Rule. Is it that this kind of integration is not possible or there is no provision from AWS at the moment. Or I'm I missing something.

Can someone please help me understand this?
Thanks!

Accepted Answer

Based on your working Postman example (below from your comment above-thanks!):

> "https://xxxxx-test-function-invoked-b-xxxxx-xx.x.run.app"  (x = obfuscated data) - this is the url of google cloud function which I need to trigger.

> Apart from this I'm using Bearer token for authorization ; Body = {"Hello": "from postman"};
7 automatically generated headers including Content-Type ; Content-Length ; Host ; User-Agent ; Accept ; Acceept-Encoding ; Connection.

Most likely it's the _I'm using Bearer token for authorization_ causing the issue. The AWS IoT Core Rule HTTP action will need to include the bearer token as part of the rule. This is problematic since access token will have a lifetime and need to be renewed. The HTTP Action can pull a value from the message payload, but I assume the devices won't have that available.

Is there a reason not to use AWS Lambda for the serverless aspect? That is also an available Rules Action. If Google Cloud Functions are needed, you can put the function behind a Google API Gateway and then [secure with an API Key](https://cloud.google.com/api-gateway/docs/secure-traffic-console#securing_access_by_using_an_api_key) that hits that endpoint which in turn would invoke the Cloud Function. You will still have to setup a second method for validating the URL via the `confirmationUrl` parameter. Ssee [Working with HTTP topics](https://docs.aws.amazon.com/iot/latest/developerguide/rule-destination.html) for more details.

Edit: details from comment below:

`static_header_key` and `substitutable_header_key` are placeholders. For instance, `Authorization: Bearer token_contents` would be look like this in the rule:

```json
        "actions": [
            { 
                "http": { 
                    "url": "https://www.example.com/subpath",
                    "headers": [
                        { 
                            "key": "Authorization", 
                            "value": "Bearer token_contents" 
                        }
                    ] 
                } 
            }
        ]
```
the Substitution key would be used if wanted to use values from the payload as a modified key name or key value. Try changing to what you see in Postman's Request header (may only need the one key/value pair).

If that works with a fresh token, then the next step would be to determine how to include a API key in your rule definition via the Google API Gateway->Google Cloud Function, and also to understand the security concerns if the key is exposed.

I'm not well-versed with Google Cloud in general, :), but I would probably [start here](https://cloud.google.com/api-gateway/docs/get-started-cloud-functions) with Google's docs. Then you can generate an API key for the function.

Hope this helps, please reply back with any clarifications needed.

AWS IoT Core Integration with Google Cloud Function with HTTP Rule Action

Relevant content