[AWS IoT Core] ルールSQLに追加された get_registry_data() 関数を試してみました

# 依存関係のインストール
cd cdk
pnpm install

# デプロイ
cdk deploy

aws iot add-thing-to-thing-group \
  --thing-name test-device-001 \
  --thing-group-name production-devices

# 証明書の作成
aws iot create-keys-and-certificate \
  --set-as-active \
  --certificate-pem-outfile client/certs/device.cert.pem \
  --private-key-outfile client/certs/device.private.key \
  --output json > certificate-output.json

# 証明書ARNを取得
CERT_ARN=$(cat certificate-output.json | jq -r '.certificateArn')

# ルートCA証明書のダウンロード
curl -o client/certs/AmazonRootCA1.pem \
  https://www.amazontrust.com/repository/AmazonRootCA1.pem

# 証明書をThingとポリシーにアタッチ
aws iot attach-thing-principal \
  --thing-name test-device-001 \
  --principal $CERT_ARN

aws iot attach-policy \
  --policy-name test-device-001-policy \
  --target $CERT_ARN

cd client
pip install -r requirements.txt

python publish_message.py \
  --endpoint <IoT_ENDPOINT> \
  --thing-name test-device-001 \
  --count 5 \
  --interval 2

SELECT
  *,
  clientId,
  timestamp,
  'DESCRIBE_THING' as rule_type,
  get_registry_data("DescribeThing", 'test-device-001', 'arn:aws:iam::xxx:role/GetRegistryDataRole') as deviceInfo
FROM
  'device/+/telemetry'

SELECT
  *,
  clientId,
  timestamp,
  'LIST_THING_GROUPS' as rule_type,
  get_registry_data("ListThingGroupsForThing", 'test-device-001', 'arn:aws:iam::xxx:role/GetRegistryDataRole') as deviceGroups
FROM
  'device/+/telemetry'

// get_registry_data用の統合IAMロール
const registryDataRole = new iam.Role(this, 'RegistryDataRole', {
  roleName: 'GetRegistryDataRole',
  assumedBy: new iam.ServicePrincipal('iot.amazonaws.com'),
  description: 'Unified role for get_registry_data() function to access Thing registry',
});

// get_registry_data()で必要な権限を付与
registryDataRole.addToPolicy(
  new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: [
      'iot:DescribeThing',
      'iot:ListThingGroupsForThing',
    ],
    resources: ['*'],
  })
);

// IoT Rule 1: DescribeThing API用
const describeThingRule = new iot.CfnTopicRule(this, 'DescribeThingRule', {
  ruleName: 'DescribeThingRule',
  topicRulePayload: {
    sql: `
      SELECT
        *,
        clientId,
        timestamp,
        'DESCRIBE_THING' as rule_type,
        get_registry_data("DescribeThing", '${thingName}', '${registryDataRole.roleArn}') as deviceInfo
      FROM
        'device/+/telemetry'
    `,
    description: 'Test get_registry_data("DescribeThing") API',
    actions: [
      {
        lambda: {
          functionArn: getRegistryDataFunction.functionArn,
        },
      },
    ],
    ruleDisabled: false,
    awsIotSqlVersion: '2016-03-23',
  },
});

def handler(event: dict, context: dict) -> dict:
    """
    IoT Ruleから送信されたイベントをCloudWatch Logsに出力するLambda関数

    get_registry_data()で取得したデバイス情報を含むイベント全体をログに記録します。
    IoT RuleのSQL内のrule_typeフィールドでどちらのルールから呼び出されたか識別します。
    """
    # IoT RuleのSQLで設定されたrule_typeを取得（環境変数は使用しない）
    rule_type = event.get("rule_type", "UNKNOWN")
    logger.info(f"========== {rule_type} ==========")
    logger.info(json.dumps(event, indent=2, ensure_ascii=False))

-- ❌ clientIdはMQTT接続のクライアントIDであり、Thing名とは限らない
get_registry_data("DescribeThing", clientId, roleArn)

-- ✅ Thing名を明示的に指定するか、トピックから抽出
get_registry_data("DescribeThing", 'test-device-001', roleArn)
-- または
get_registry_data("DescribeThing", topic(2), roleArn)  -- device/THING_NAME/telemetry の場合

-- ❌ エラー: "Get registry data requires its last parameter to be roleArn"
get_registry_data("DescribeThing", thingName)

-- ✅ 正常動作
get_registry_data("DescribeThing", thingName, 'arn:aws:iam::xxx:role/RoleName')

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "iot:DescribeThing",
        "iot:ListThingGroupsForThing"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

[logLevel]: ERROR
[eventType]: RuleExecution
[reason]: ExternFunctionException
[ruleName]: DescribeThingRule
[details]: Function 'GetRegistryData' failed to execute for rule 'DescribeThingRule'. Could not retrieve registry data. Received error message User: arn:aws:sts::xxxxxxxxxxxx:assumed-role/GetRegistryDataRole/jxDJ4011 is not authorized to perform: iot:DescribeThing on resource: arn:aws:iot:ap-northeast-1:xxxxxxxxxxxx:thing/test-device-001 because no identity-based policy allows the iot:DescribeThing action (Service: Iot; Status Code: 403; Error Code: AccessDeniedException; Request ID: d2e5bfaf-425d-4f3c-a2e1-864b0ded73e0)

-- ❌ エラー: "Rule cannot contain more than 1 get_registry_data function calls"
SELECT
  get_registry_data("DescribeThing", thingName, roleArn) as deviceInfo,
  get_registry_data("ListThingGroupsForThing", thingName, roleArn) as deviceGroups
FROM 'device/+/telemetry'