基于所有权的AWS IoT设备访问安全方案技术问询

Great question! The static customer managed policy approach hits a hard limit at 1500 policies, and you also need flexible device ownership transfers without touching device-side config—let’s break down the best AWS-native solutions to solve this:

1. Dynamic IAM Policies with IoT Core Attribute Conditions #

This is the simplest, most scalable approach for most use cases. Instead of creating a unique policy per user, we use policy variables and IoT Thing attributes to enforce ownership in real time.

How it works: #

• Tag IoT Things with ownership: Add an owner attribute to each IoT Thing, set to the Cognito user’s sub (unique user ID) or username.
• Dynamic IAM Policy: Use Cognito Identity Pool to generate a policy that checks if the user’s ID matches the device’s owner attribute before allowing access to its MQTT topics.
• Seamless ownership transfer: Just update the owner attribute on the IoT Thing—no policy edits or device config changes needed.

Example IAM Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect",
        "iot:Publish",
        "iot:Subscribe",
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:${region}:${account}:client/${cognito-identity.amazonaws.com:sub}",
        "arn:aws:iot:${region}:${account}:topic/$aws/things/${iot:ThingName}/#"
      ],
      "Condition": {
        "StringEquals": {
          "iot:Thing.Attributes.owner": "${cognito-identity.amazonaws.com:sub}"
        }
      }
    }
  ]
}

Transfer Ownership (AWS CLI Example):

# Update the device's owner attribute to the new user's sub
aws iot update-thing --thing-name "smart-thermo-001" --attribute-payload '{"attributes": {"owner": "new-user-sub-789"}, "merge": true}'

2. IoT Thing Groups + Group-Based Permissions #

If you already organize devices into groups, you can tie user access to their specific device groups for cleaner management.

How it works: #

• Create per-user Thing Groups: For each Cognito user, create a group named like user-{user-sub}-devices.
• Assign devices to groups: Add a user’s devices to their corresponding group.
• Policy with group condition: Write an IAM policy that allows access only to devices in the user’s group.

Example IAM Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect",
        "iot:Publish",
        "iot:Subscribe",
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:${region}:${account}:client/${cognito-identity.amazonaws.com:sub}",
        "arn:aws:iot:${region}:${account}:topic/$aws/things/${iot:ThingName}/#"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "iot:ThingGroupNames": "user-${cognito-identity.amazonaws.com:sub}-devices"
        }
      }
    }
  ]
}

Transfer Ownership (AWS CLI Example):

# Remove device from old user's group
aws iot remove-thing-from-thing-group --thing-name "smart-thermo-001" --thing-group-name "user-old-sub-123-devices"

# Add device to new user's group
aws iot add-thing-to-thing-group --thing-name "smart-thermo-001" --thing-group-name "user-new-sub-789-devices"

3. Custom IoT Authorizer (For Complex Logic) #

If you need advanced rules (like temporary access, multi-tenant shared devices, or custom validation), a Lambda-powered custom authorizer gives you full control.

How it works: #

• Build a Lambda authorizer: When a user connects via MQTT, the Lambda checks if the user owns the device by querying IoT Thing attributes.
• Dynamic permission response: The Lambda returns an allow/deny policy based on the ownership check.
• No policy updates needed: Ownership transfers only require updating the IoT Thing’s owner attribute—authorizer checks are real-time.

Example Lambda Authorizer (Python):

import boto3
import jwt

iot_client = boto3.client('iot')

def lambda_handler(event, context):
    # Extract Cognito token from MQTT username field
    auth_token = event['protocolData']['mqtt']['username']
    decoded_token = jwt.decode(auth_token, options={"verify_signature": False})
    user_sub = decoded_token['sub']
    
    # Get device name from MQTT client ID (assumed to match Thing name)
    thing_name = event['clientId']
    
    # Check if device belongs to the user
    thing_details = iot_client.describe_thing(thingName=thing_name)
    device_owner = thing_details['attributes'].get('owner')
    
    if device_owner == user_sub:
        # Return allow policy for this device's topics
        return {
            "isAuthenticated": True,
            "principalId": user_sub,
            "policyDocuments": [
                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": ["iot:Connect"],
                            "Resource": f"arn:aws:iot:{context.region}:{context.account_id}:client/{thing_name}"
                        },
                        {
                            "Effect": "Allow",
                            "Action": ["iot:Publish", "iot:Subscribe", "iot:Receive"],
                            "Resource": f"arn:aws:iot:{context.region}:{context.account_id}:topic/$aws/things/{thing_name}/#"
                        }
                    ]
                }
            ]
        }
    else:
        # Deny access if user doesn't own the device
        return {
            "isAuthenticated": False,
            "principalId": user_sub
        }

Which Solution Should You Choose? #

• Dynamic IAM Policies: Best for simple, scalable ownership checks—no extra services, minimal setup.
• Thing Groups: Ideal if you already use groups for device management or need to bundle permissions for multiple devices.
• Custom Authorizers: Perfect for complex scenarios where you need custom logic beyond basic ownership checks.

内容的提问来源于stack exchange，提问作者Maciej Grodzki