【AWS IoT Core】 JITP（Just-In-Time Provisioning）機能をJITRと比較しながら実装してみた

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as iot from 'aws-cdk-lib/aws-iot';
import * as iam from 'aws-cdk-lib/aws-iam'; // iamモジュールをインポート

export class JitpSampleCdkStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // IoTポリシーを定義（デバイス接続用の基本ポリシー）
    new iot.CfnPolicy(this, 'DeviceBasePolicy', {
      policyName: 'DeviceBasePolicy',
      policyDocument: {
        Version: '2012-10-17',
        Statement: [
          {
            Effect: 'Allow',
            Action: ['iot:Connect'],
            Resource: [`arn:aws:iot:${this.region}:${this.account}:client/\${iot:ClientId}`]
          },
          {
            Effect: 'Allow',
            Action: ['iot:Publish', 'iot:Receive'],
            Resource: [`arn:aws:iot:${this.region}:${this.account}:topic/devices/*`]
          },
          {
            Effect: 'Allow',
            Action: ['iot:Subscribe'],
            Resource: [`arn:aws:iot:${this.region}:${this.account}:topicfilter/devices/*`]
          }
        ]
      }
    });

    // JITPプロビジョニング用IAMロールを作成
    const jitpProvisioningRole = new iam.Role(this, 'JitpProvisioningRole', {
      roleName: 'JitpProvisioningRole', // 必要に応じてロール名を変更してください
      assumedBy: new iam.ServicePrincipal('iot.amazonaws.com'),
      inlinePolicies: {
        JitpProvisioningPermissions: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              effect: iam.Effect.ALLOW,
              actions: [
                "iot:CreateThing",
                "iot:AttachPolicy", // テンプレートで既存ポリシーをアタッチするため
                "iot:AttachThingPrincipal",
                "iot:UpdateCertificate",
                "iot:AddThingToThingGroup",
                "iot:RegisterThing",
                "iot:DescribeThing",
                "iot:ListThingGroupsForThing",
                "iot:DescribeCertificate",
                "iot:DescribeThingType",
                "iot:DescribeThingGroup",
                "iot:GetPolicy",
                "iot:AttachPrincipalPolicy"
                // "iot:CreatePolicy" // テンプレートが新しいポリシーを作成する場合に必要
              ],
              resources: ["*"], // 本番環境ではリソースをより具体的に指定することを推奨します
            }),
          ],
        }),
      },
    });

    // JITPプロビジョニング用IAMロールのARNを出力
    new cdk.CfnOutput(this, 'JitpProvisioningRoleArn', {
      value: jitpProvisioningRole.roleArn,
      description: 'ARN of the IAM role for JITP provisioning',
      exportName: 'JitpProvisioningRoleArnOutput',
    });
  }
}

cdk deploy

{
    "Parameters": {
      "AWS::IoT::Certificate::CommonName": {
        "Type": "String"
      },
      "AWS::IoT::Certificate::SerialNumber": {
        "Type": "String"
      },
      "AWS::IoT::Certificate::Country": {
        "Type": "String"
      },
      "AWS::IoT::Certificate::Id": {
        "Type": "String"
      }
    },
    "Resources": {
      "certificate": {
        "Properties": {
          "CertificateId": {
            "Ref": "AWS::IoT::Certificate::Id"
          },
          "Status": "ACTIVE"
        },
        "Type": "AWS::IoT::Certificate"
      },
      "policy": {
        "Properties": {
          "PolicyName": "DeviceBasePolicy"
        },
        "Type": "AWS::IoT::Policy"
      },
      "thing": {
        "Properties": {
          "ThingName": {
            "Ref": "AWS::IoT::Certificate::CommonName"
          },
          "AttributePayload": {
            "version": "v1",
            "serialNumber": {
              "Ref": "AWS::IoT::Certificate::SerialNumber"
            }
          },
          "ThingTypeName": "lightBulb-versionA",
          "ThingGroups": [
            "v1-lightbulbs",
            {
              "Ref": "AWS::IoT::Certificate::Country"
            }
          ]
        },
        "Type": "AWS::IoT::Thing",
        "OverrideSettings": {
          "AttributePayload": "MERGE",
          "ThingTypeName": "REPLACE",
          "ThingGroups": "DO_NOTHING"
        }
      }
    }
  }

# CA証明書用のディレクトリを作成
mkdir -p ~/aws-iot-jitp/ca
cd ~/aws-iot-jitp/ca

# CAプライベートキーの生成
openssl genrsa -out rootCA.key 2048

# CA証明書の作成 (例: Common Name を MyDeviceRootCA とする場合)
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem -subj "/CN=MyDeviceRootCA"

aws iot get-registration-code

{
    "registrationCode": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

openssl genrsa -out verification_cert.key 2048

openssl req -new \
-key verification_cert.key \
-out verification_cert.csr

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []: <1.で取得した登録コード>
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

openssl x509 -req \
-in verification_cert.csr \
-CA rootCA.pem \
-CAkey rootCA.key \
-CAcreateserial \
-out verification_cert.pem \
-days 500 -sha256

Signature ok
subject=C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN = <1.で取得した登録コード>
Getting CA Private Key

aws iot register-ca-certificate  \
--ca-certificate file://rootCA.pem \
--verification-cert file://verification_cert.pem \
--registration-config '{
    "templateBody": "{\"Parameters\":{\"AWS::IoT::Certificate::CommonName\":{\"Type\":\"String\"},\"AWS::IoT::Certificate::SerialNumber\":{\"Type\":\"String\"},\"AWS::IoT::Certificate::Country\":{\"Type\":\"String\"},\"AWS::IoT::Certificate::Id\":{\"Type\":\"String\"}},\"Resources\":{\"certificate\":{\"Properties\":{\"CertificateId\":{\"Ref\":\"AWS::IoT::Certificate::Id\"},\"Status\":\"ACTIVE\"},\"Type\":\"AWS::IoT::Certificate\"},\"policy\":{\"Properties\":{\"PolicyName\":\"DeviceBasePolicy\"},\"Type\":\"AWS::IoT::Policy\"},\"thing\":{\"Properties\":{\"ThingName\":{\"Ref\":\"AWS::IoT::Certificate::CommonName\"},\"AttributePayload\":{\"version\":\"v1\",\"serialNumber\":{\"Ref\":\"AWS::IoT::Certificate::SerialNumber\"}},\"ThingTypeName\":\"lightBulb-versionA\",\"ThingGroups\":[\"v1-lightbulbs\",{\"Ref\":\"AWS::IoT::Certificate::Country\"}]},\"Type\":\"AWS::IoT::Thing\",\"OverrideSettings\":{\"AttributePayload\":\"MERGE\",\"ThingTypeName\":\"REPLACE\",\"ThingGroups\":\"DO_NOTHING\"}}}}",
    "roleArn": "<CDKで出力されたARN>"
  }'

{
    "certificateArn": "arn:aws:iot:ap-northeast-1:xxx:cacert/yyy",
    "certificateId": "zzz"
}

aws iot update-ca-certificate --profile private \
  --certificate-id <取得したcertificateId> \
  --new-status ACTIVE \
  --new-auto-registration-status ENABLE \
  --registration-config '{
    "templateBody": "{\"Parameters\":{\"AWS::IoT::Certificate::CommonName\":{\"Type\":\"String\"},\"AWS::IoT::Certificate::SerialNumber\":{\"Type\":\"String\"},\"AWS::IoT::Certificate::Country\":{\"Type\":\"String\"},\"AWS::IoT::Certificate::Id\":{\"Type\":\"String\"}},\"Resources\":{\"certificate\":{\"Properties\":{\"CertificateId\":{\"Ref\":\"AWS::IoT::Certificate::Id\"},\"Status\":\"ACTIVE\"},\"Type\":\"AWS::IoT::Certificate\"},\"policy\":{\"Properties\":{\"PolicyName\":\"DeviceBasePolicy\"},\"Type\":\"AWS::IoT::Policy\"},\"thing\":{\"Properties\":{\"ThingName\":{\"Ref\":\"AWS::IoT::Certificate::CommonName\"},\"AttributePayload\":{\"version\":\"v1\",\"serialNumber\":{\"Ref\":\"AWS::IoT::Certificate::SerialNumber\"}},\"ThingTypeName\":\"lightBulb-versionA\",\"ThingGroups\":[\"v1-lightbulbs\",{\"Ref\":\"AWS::IoT::Certificate::Country\"}]},\"Type\":\"AWS::IoT::Thing\",\"OverrideSettings\":{\"AttributePayload\":\"MERGE\",\"ThingTypeName\":\"REPLACE\",\"ThingGroups\":\"DO_NOTHING\"}}}}",
    "roleArn": "<CDKで出力されたARN>"
  }'

# デバイス証明書用のディレクトリを作成
mkdir -p ~/aws-iot-jitp/device
cd ~/aws-iot-jitp/device

# デバイスプライベートキーの生成
openssl genrsa -out device.key 2048

# 証明書署名要求(CSR)の作成（デバイスIDを埋め込む）
openssl req -new -key device.key -out device.csr -subj "/C=JP/CN=JitpDevice/serialNumber=DEVICE123456"

# CSRをCA証明書で署名
openssl x509 -req -in device.csr -CA ~/aws-iot-jitp/ca/rootCA.pem -CAkey ~/aws-iot-jitp/ca/rootCA.key -CAcreateserial -out device.crt -days 365 -sha256

# デバイスの証明書とCA証明書を結合
cat device.crt ~/aws-iot-jitp/ca/rootCA.pem > deviceAndCA.crt

aws iot describe-endpoint --endpoint-type iot:Data-ATS

{
    "endpointAddress": "xxxxxxxxxxxxxx-ats.iot.ap-northeast-1.amazonaws.com"
}

curl -o ~/aws-iot-jitp/AmazonRootCA1.pem https://www.amazontrust.com/repository/AmazonRootCA1.pem

import time
import json
import argparse
import AWSIoTPythonSDK.MQTTLib as AWSIoTPyMQTT

# 引数の解析
parser = argparse.ArgumentParser()
parser.add_argument("--endpoint", required=True, help="AWS IoT Core endpoint")
parser.add_argument("--cert", required=True, help="Path to certificate file")
parser.add_argument("--key", required=True, help="Path to private key file")
parser.add_argument("--ca", required=True, help="Path to CA certificate file (AmazonRootCA1.pem)")
parser.add_argument("--device-id", required=True, help="Device ID (used as client ID)")
args = parser.parse_args()

# MQTT クライアントの設定
client_id = args.device_id
mqtt_client = AWSIoTPyMQTT.AWSIoTMQTTClient(client_id)
mqtt_client.configureEndpoint(args.endpoint, 8883)
mqtt_client.configureCredentials(args.ca, args.key, args.cert)

# MQTT 接続パラメータの設定
mqtt_client.configureAutoReconnectBackoffTime(1, 32, 20)
mqtt_client.configureOfflinePublishQueueing(-1)
mqtt_client.configureDrainingFrequency(2)
mqtt_client.configureConnectDisconnectTimeout(10)
mqtt_client.configureMQTTOperationTimeout(5)

# 接続コールバック関数
def simple_on_online_callback():
    print("Client is online.")

# onOnlineイベントに関数を割り当て（接続成功時に呼び出される）
mqtt_client.onOnline = simple_on_online_callback

# 接続試行
print(f"Attempting to connect to AWS IoT Core as device {args.device_id}...")
try:
    if mqtt_client.connect(10): # 接続タイムアウト10秒
        print("Connection successful.")
        # メッセージ発行
        topic = f"devices/{args.device_id}/status"
        message = {
            "message": f"Hello from device {args.device_id}",
            "timestamp": time.time()
        }
        print(f"Publishing message to topic: {topic}")
        mqtt_client.publish(topic, json.dumps(message), 1) # QoS 1

        # メッセージが送信され、コールバックが処理されるのを少し待つ
        time.sleep(5)
        print("Disconnecting...")
        mqtt_client.disconnect()
        print("Disconnected.")
    else:
        print("Connect attempt failed or timed out.")
except Exception as e:
    print(f"An error occurred: {str(e)}")

pip install AWSIoTPythonSDK

# JITP接続テスト
python device_test.py \
  --endpoint xxx-ats.iot.ap-northeast-1.amazonaws.com \
  --cert ~/aws-iot-jitp/device/deviceAndCA.crt \
  --key ~/aws-iot-jitp/device/device.key \
  --ca ~/aws-iot-jitp/AmazonRootCA1.pem \
  --device-id DEVICE123456

Attempting to connect to AWS IoT Core as device DEVICE123456...
Connect timed out
An error occurred: 

Attempting to connect to AWS IoT Core as device DEVICE123456...
Client is online.
Connection successful.
Publishing message to topic: devices/DEVICE123456/status
Disconnecting...
Disconnected.