【AWS IoT Core】 AWS CloudShellでデバイス証明書を一括で発行してみた

aws s3 mb s3://sample-yjinno-your-iot-certificates-bucket 

cat << 'EOF' > simple_iot_policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect",
        "iot:Publish",
        "iot:Subscribe",
        "iot:Receive"
      ],
      "Resource": "*"
    }
  ]
}
EOF

aws iot create-policy \
  --policy-name SimpleIoTDevicePolicy \
  --policy-document file://simple_iot_policy.json

#!/bin/bash

# --- 設定項目 ---
NUM_CERTIFICATES=10       # 発行する証明書の数
S3_BUCKET="sample-yjinno-your-iot-certificates-bucket" # 証明書を保管するS3バケット名 (事前に作成)
S3_PREFIX="certificates"  # S3バケット内のプレフィックス (例: certificates/device-001/)
THING_NAME_PREFIX="my-device-" # モノの名前のプレフィックス (例: my-device-001)
IOT_POLICY_NAME="SimpleIoTDevicePolicy" # 事前に作成したIoTポリシー名
REGION="ap-northeast-1"   # AWSリージョン

# --- スクリプト本体 ---
set -e # エラーが発生したらスクリプトを終了

echo "Starting certificate provisioning..."
echo "Number of certificates to create: ${NUM_CERTIFICATES}"
echo "Target S3 Bucket: s3://${S3_BUCKET}/${S3_PREFIX}"
echo "Thing name prefix: ${THING_NAME_PREFIX}"
echo "IoT Policy name: ${IOT_POLICY_NAME}"
echo "Region: ${REGION}"

# IoTポリシーの存在確認
echo "Checking if IoT policy '${IOT_POLICY_NAME}' exists..."
aws iot get-policy --policy-name "${IOT_POLICY_NAME}" --region "${REGION}" > /dev/null
if [ $? -ne 0 ]; then
  echo "ERROR: IoT policy '${IOT_POLICY_NAME}' does not exist. Please create the policy first."
  exit 1
fi
echo "IoT policy '${IOT_POLICY_NAME}' found."

# 一時作業ディレクトリ作成
WORK_DIR=$(mktemp -d)
echo "Working directory: ${WORK_DIR}"
cd "${WORK_DIR}"

for i in $(seq 1 ${NUM_CERTIFICATES})
do
  DEVICE_ID=$(printf "%s%03d" "${THING_NAME_PREFIX}" "${i}")
  echo "----------------------------------------"
  echo "Processing device: ${DEVICE_ID}"

  # 1. モノを作成 (存在しない場合 - オプション)
  aws iot create-thing --thing-name "${DEVICE_ID}" --region "${REGION}" > /dev/null || echo "Thing ${DEVICE_ID} already exists or failed to create."

  # 2. キーペアと証明書を作成 & 有効化
  echo "Creating keys and certificate for ${DEVICE_ID}..."
  OUTPUT=$(aws iot create-keys-and-certificate \
            --set-as-active \
            --region "${REGION}" \
            --output json)

  if [ $? -ne 0 ]; then
    echo "ERROR: Failed to create keys and certificate for ${DEVICE_ID}. Skipping."
    continue # エラーが発生したら次のループへ
  fi

  CERT_ARN=$(echo "${OUTPUT}" | jq -r '.certificateArn')
  CERT_ID=$(echo "${OUTPUT}" | jq -r '.certificateId')
  CERT_PEM=$(echo "${OUTPUT}" | jq -r '.certificatePem')
  KEY_PAIR_PUBLIC=$(echo "${OUTPUT}" | jq -r '.keyPair.PublicKey')
  KEY_PAIR_PRIVATE=$(echo "${OUTPUT}" | jq -r '.keyPair.PrivateKey') # ★★★ 秘密鍵 ★★★

  echo "Certificate ID: ${CERT_ID}"
  echo "Certificate ARN: ${CERT_ARN}"

  # ファイルに保存
  CERT_FILE="${DEVICE_ID}_${CERT_ID}_cert.pem"
  PUB_KEY_FILE="${DEVICE_ID}_${CERT_ID}_pub.key"
  PRV_KEY_FILE="${DEVICE_ID}_${CERT_ID}_prv.key" # ★★★ 秘密鍵ファイル ★★★

  echo "${CERT_PEM}" > "${CERT_FILE}"
  echo "${KEY_PAIR_PUBLIC}" > "${PUB_KEY_FILE}"
  echo "${KEY_PAIR_PRIVATE}" > "${PRV_KEY_FILE}"
  echo "Files created locally: ${CERT_FILE}, ${PUB_KEY_FILE}, ${PRV_KEY_FILE}"

  # 3. 証明書をモノにアタッチ (オプション - モノを作成した場合)
  echo "Attaching certificate ${CERT_ARN} to thing ${DEVICE_ID}..."
  aws iot attach-thing-principal \
   --thing-name "${DEVICE_ID}" \
   --principal "${CERT_ARN}" \
   --region "${REGION}"
  if [ $? -ne 0 ]; then
   echo "WARNING: Failed to attach certificate to thing ${DEVICE_ID}."
  fi

  # 4. 証明書にIoTポリシーをアタッチ ★★★ 新規追加 ★★★
  echo "Attaching IoT policy '${IOT_POLICY_NAME}' to certificate ${CERT_ARN}..."
  aws iot attach-principal-policy \
   --policy-name "${IOT_POLICY_NAME}" \
   --principal "${CERT_ARN}" \
   --region "${REGION}"
  if [ $? -ne 0 ]; then
   echo "WARNING: Failed to attach IoT policy to certificate ${CERT_ARN}."
  else
   echo "IoT policy '${IOT_POLICY_NAME}' successfully attached to certificate."
  fi

  # 5. S3にアップロード (SSE-S3で暗号化)
  S3_DEVICE_PATH="${S3_PREFIX}/${DEVICE_ID}"
  echo "Uploading files to s3://${S3_BUCKET}/${S3_DEVICE_PATH}/ ..."

  aws s3 cp "${CERT_FILE}" "s3://${S3_BUCKET}/${S3_DEVICE_PATH}/${CERT_FILE}" --sse AES256
  aws s3 cp "${PUB_KEY_FILE}" "s3://${S3_BUCKET}/${S3_DEVICE_PATH}/${PUB_KEY_FILE}" --sse AES256
  aws s3 cp "${PRV_KEY_FILE}" "s3://${S3_BUCKET}/${S3_DEVICE_PATH}/${PRV_KEY_FILE}" --sse AES256
  if [ $? -ne 0 ]; then
    echo "ERROR: Failed to upload files to S3 for ${DEVICE_ID}. Check permissions and bucket settings."
    # エラー処理
    continue
  fi

  echo "Successfully processed ${DEVICE_ID}."

  # レート制限回避のための待機 (必要に応じて調整)
  sleep 0.5
done

# 一時作業ディレクトリ削除
echo "Cleaning up working directory: ${WORK_DIR}"
rm -rf "${WORK_DIR}"

echo "----------------------------------------"
echo "Certificate provisioning finished."

s3://your-iot-certificates-bucket/
└── certificates/
    ├── my-device-001/
    │   ├── my-device-001_[証明書ID]_cert.pem
    │   ├── my-device-001_[証明書ID]_pub.key
    │   └── my-device-001_[証明書ID]_prv.key
    └── my-device-002/
        └── ...

Processing device: my-device-XXX
Creating keys and certificate for my-device-XXX...
Certificate ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Certificate ARN: arn:aws:iot:ap-northeast-1:XXXXXXXXXXXX:cert/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Files created locally: my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_cert.pem, my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_pub.key, my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_prv.key
Attaching certificate arn:aws:iot:ap-northeast-1:XXXXXXXXXXXX:cert/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx to thing my-device-XXX...
Attaching IoT policy 'SimpleIoTDevicePolicy' to certificate arn:aws:iot:ap-northeast-1:XXXXXXXXXXXX:cert/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
IoT policy 'SimpleIoTDevicePolicy' successfully attached to certificate.
Uploading files to s3://your-iot-certificates-bucket/certificates/my-device-XXX/ ...
upload: ./my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_cert.pem to s3://your-iot-certificates-bucket/certificates/my-device-XXX/my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_cert.pem
upload: ./my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_pub.key to s3://your-iot-certificates-bucket/certificates/my-device-XXX/my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_pub.key
upload: ./my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_prv.key to s3://your-iot-certificates-bucket/certificates/my-device-XXX/my-device-XXX_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_prv.key
Successfully processed my-device-XXX.

nano iot_certificate_provisioning.sh

chmod +x iot_certificate_provisioning.sh

NUM_CERTIFICATES=10
S3_BUCKET="your-iot-certificates-bucket"
THING_NAME_PREFIX="MyDevice"
REGION="ap-northeast-1"

./iot_certificate_provisioning.sh

aws s3 ls s3://sample-yjinno-your-iot-certificates-bucket/certificates/ --recursive

s3://your-iot-certificates-bucket/
└── certificates/
    ├── MyDevice-001/
    │   ├── MyDevice-001_[証明書ID]_cert.pem
    │   ├── MyDevice-001_[証明書ID]_pub.key
    │   └── MyDevice-001_[証明書ID]_prv.key
    ├── MyDevice-002/
    │   ├── MyDevice-002_[証明書ID]_cert.pem
    │   ├── MyDevice-002_[証明書ID]_pub.key
    │   └── MyDevice-002_[証明書ID]_prv.key
    └── ...

aws iot list-things

# AWS IoT Coreエンドポイントを取得
aws iot describe-endpoint --endpoint-type iot:Data-ATS

{
    "endpointAddress": "xxxxxxxxxx-ats.iot.ap-northeast-1.amazonaws.com"
}

curl -o ./AmazonRootCA1.pem https://www.amazontrust.com/repository/AmazonRootCA1.pem

pip install awsiotsdk

python test_device_connection.py