AWS IoT Core に Mosquitto でメッセージを Pub/Sub する構成を AWS CDK で実装してみた

# サブスクライブ用の秘密鍵および証明書の作成
aws iot create-keys-and-certificate \
  --set-as-active \
  --public-key-outfile subscriber_public_key.pem \
  --private-key-outfile subscriber_private_key.pem \
  --certificate-pem-outfile subscriber_cert.pem

# パブリッシュ用の秘密鍵および証明書の作成
aws iot create-keys-and-certificate \
  --set-as-active \
  --public-key-outfile publisher_public_key.pem \
  --private-key-outfile publisher_private_key.pem \
  --certificate-pem-outfile publisher_cert.pem

import * as cdk from "aws-cdk-lib";
import * as iot from "aws-cdk-lib/aws-iot";
import { Construct } from "constructs";

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * サブスクライブ用証明書 ID
     */
    const subscriberCertificateId = "<サブスクライブ用証明書の ID>";

    /**
     * パブリッシュ用証明書 ID
     */
    const publisherCertificateId = "<パブリッシュ用証明書の ID>";

    /**
     * 証明書 ARN の作成
     */
    const subscriberCertificateArn = cdk.Arn.format(
      {
        service: "iot",
        resource: "cert",
        resourceName: subscriberCertificateId,
      },
      this
    );
    const publisherCertificateArn = cdk.Arn.format(
      {
        service: "iot",
        resource: "cert",
        resourceName: publisherCertificateId,
      },
      this
    );

    /**
     * IoT Thing（サブスクライブ用デバイス）の作成
     */
    const subscriberThing = new iot.CfnThing(this, "SubscriberThing", {
      thingName: "subscriber-device-001",
    });

    /**
     * IoT Thing（パブリッシュ用デバイス）の作成
     */
    const publisherThing = new iot.CfnThing(this, "PublisherThing", {
      thingName: "publisher-device-001",
    });

    /**
     * サブスクライブ用ポリシーの作成
     */
    const subscriberPolicy = new iot.CfnPolicy(this, "SubscriberPolicy", {
      policyName: "SubscriberOnlyPolicy",
      policyDocument: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Allow",
            Action: ["iot:Connect"],
            Resource: cdk.Arn.format(
              {
                service: "iot",
                resource: "client",
                resourceName: "${iot:Connection.Thing.ThingName}", // クライアント ID として Thing 名を使用する前提でポリシー変数を使用
              },
              this
            ),
            Condition: {
              Bool: {
                "iot:Connection.Thing.IsAttached": ["true"], // 証明書がアタッチされている Thing のみ接続を許可
              },
            },
          },
          {
            Effect: "Allow",
            Action: ["iot:Subscribe"],
            Resource: [
              cdk.Arn.format(
                {
                  service: "iot",
                  resource: "topicfilter",
                  resourceName: "hoge", // hoge トピックへのサブスクライブを許可
                },
                this
              ),
            ],
          },
          {
            Effect: "Allow",
            Action: ["iot:Receive"],
            Resource: [
              cdk.Arn.format(
                {
                  service: "iot",
                  resource: "topic",
                  resourceName: "hoge", // hoge トピックからのメッセージ受信を許可
                },
                this
              ),
            ],
          },
        ],
      },
    });

    /**
     * パブリッシュ用ポリシーの作成
     */
    const publisherPolicy = new iot.CfnPolicy(this, "PublisherPolicy", {
      policyName: "PublisherOnlyPolicy",
      policyDocument: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Allow",
            Action: ["iot:Connect"],
            Resource: cdk.Arn.format(
              {
                service: "iot",
                resource: "client",
                resourceName: "${iot:Connection.Thing.ThingName}", // クライアント ID として Thing 名を使用する前提でポリシー変数を使用
              },
              this
            ),
            Condition: {
              Bool: {
                "iot:Connection.Thing.IsAttached": ["true"], // 証明書がアタッチされている Thing のみ接続を許可
              },
            },
          },
          {
            Effect: "Allow",
            Action: ["iot:Publish"],
            Resource: [
              cdk.Arn.format(
                {
                  service: "iot",
                  resource: "topic",
                  resourceName: "hoge", // hoge トピックへのパブリッシュを許可
                },
                this
              ),
            ],
          },
        ],
      },
    });

    /**
     * サブスクライブ用証明書へのポリシーのアタッチ
     */
    const subscriberPolicyAttachment = new iot.CfnPolicyPrincipalAttachment(
      this,
      "SubscriberPolicyAttachment",
      {
        policyName: subscriberPolicy.policyName!,
        principal: subscriberCertificateArn,
      }
    );
    subscriberPolicyAttachment.addDependency(subscriberPolicy);

    /**
     * パブリッシュ用証明書へのポリシーのアタッチ
     */
    const publisherPolicyAttachment = new iot.CfnPolicyPrincipalAttachment(
      this,
      "PublisherPolicyAttachment",
      {
        policyName: publisherPolicy.policyName!,
        principal: publisherCertificateArn,
      }
    );
    publisherPolicyAttachment.addDependency(publisherPolicy);

    /**
     * サブスクライブ用証明書への Thing のアタッチ
     */
    const subscriberThingAttachment = new iot.CfnThingPrincipalAttachment(
      this,
      "SubscriberThingAttachment",
      {
        thingName: subscriberThing.thingName!,
        principal: subscriberCertificateArn,
      }
    );
    subscriberThingAttachment.addDependency(subscriberThing);

    /**
     * パブリッシュ用証明書への Thing のアタッチ
     */
    const publisherThingAttachment = new iot.CfnThingPrincipalAttachment(
      this,
      "PublisherThingAttachment",
      {
        thingName: publisherThing.thingName!,
        principal: publisherCertificateArn,
      }
    );
    publisherThingAttachment.addDependency(publisherThing);
  }
}

curl -o root_ca.pem \
  -s https://www.amazontrust.com/repository/AmazonRootCA1.pem

aws iot describe-endpoint --endpoint-type iot:Data-ATS

brew install mosquitto

$ DEVICE_ENDPOINT=<デバイスエンドポイント>
$ mosquitto_sub \
    --id "subscriber-device-001" \
    --cafile "root_ca.pem" \
    --cert "subscriber_cert.pem" \
    --key "subscriber_private_key.pem" \
    --host "${DEVICE_ENDPOINT}" \
    --port 8883 \
    --topic "hoge" \
    --debug

Client subscriber-device-001 sending CONNECT
Client subscriber-device-001 received CONNACK (0)
Client subscriber-device-001 sending SUBSCRIBE (Mid: 1, Topic: hoge, QoS: 0, Options: 0x00)
Client subscriber-device-001 received SUBACK
Subscribed (mid: 1): 0

Client subscriber-device-001 received PUBLISH (d0, q0, r0, m0, 'hoge', ... (57 bytes))
{
  "message": "AWS IoT コンソールからの挨拶"
}

$ DEVICE_ENDPOINT=<デバイスエンドポイント>
$ mosquitto_pub \
    --id "publisher-device-001" \
    --cafile "root_ca.pem" \
    --cert "publisher_cert.pem" \
    --key "publisher_private_key.pem" \
    --host "${DEVICE_ENDPOINT}" \
    --port 8883 \
    --topic "hoge" \
    --message '{"message":"Hello, World!"}' \
    --debug

Client publisher-device-001 sending CONNECT
Client publisher-device-001 received CONNACK (0)
Client publisher-device-001 sending PUBLISH (d0, q0, r0, m1, 'hoge', ... (27 bytes))
Client publisher-device-001 sending DISCONNECT

Client subscriber-device-001 received PUBLISH (d0, q0, r0, m0, 'hoge', ... (27 bytes))
{"message":"Hello, World!"}

# CDK スタックを削除
cdk destroy

# 証明書一覧を確認
aws iot list-certificates

# サブスクライブ用証明書の削除
SUBSCRIBER_CERT_ID="<サブスクライブ用証明書のID>"
aws iot update-certificate --certificate-id $SUBSCRIBER_CERT_ID --new-status INACTIVE
aws iot delete-certificate --certificate-id $SUBSCRIBER_CERT_ID

# パブリッシュ用証明書の削除
PUBLISHER_CERT_ID="<パブリッシュ用証明書のID>"
aws iot update-certificate --certificate-id $PUBLISHER_CERT_ID --new-status INACTIVE
aws iot delete-certificate --certificate-id $PUBLISHER_CERT_ID

# 証明書関連ファイルの削除
rm -f subscriber_public_key.pem
rm -f subscriber_private_key.pem
rm -f subscriber_cert.pem
rm -f publisher_public_key.pem
rm -f publisher_private_key.pem
rm -f publisher_cert.pem
rm -f root_ca.pem