Encryption in transit - Amazon IoT SiteWise
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Encryption in transit

Amazon IoT SiteWise has three modes of communication where data is in transit:

  • Over the internet – Communication between local devices (including gateways) and Amazon IoT SiteWise is encrypted.

  • Over the local network – Communication between OpsHub for SiteWise application and gateways is always encrypted. Communication between the SiteWise monitor application running within your browser and gateways is always encrypted. Communication between gateways and OPC-UA sources can be encrypted.

  • Between components on gateways – Communication between Amazon IoT Greengrass components on Amazon IoT SiteWise gateways isn't encrypted.

Data in transit over the internet

Amazon IoT SiteWise uses Transport Layer Security (TLS) to encrypt all communication over the internet. All data sent to the Amazon Cloud is sent over a TLS connection using MQTT or HTTPS protocols, so it's secure by default. Gateways, which run on Amazon IoT Greengrass, and property value notifications use the Amazon IoT transport security model. For more information, see Transport security in the Amazon IoT Developer Guide.

Data in transit over the local network

Amazon IoT SiteWise gateways follow OPC-UA specifications for communication with local OPC-UA sources. It's your responsibility to configure your sources to use a message security mode that encrypts data in transit.

If you choose a sign message security mode, data in transit between gateways and sources is signed but not encrypted. If you choose a sign and encrypt message security mode, the data in transit between gateways and sources is signed and encrypted. For more information about configuring sources, see Configuring data sources.

The communication between the edge console application and gateways is always encrypted by TLS. The Sitewise Edge connector on the gateway generates and stores a self-signed certificate to be able to establish a TLS connection with the edge console for Amazon IoT SiteWise application. You will need to copy this certificate from your gateway to the edge console for Amazon IoT SiteWise application before you connect the application to the gateway. This ensures that the edge console for Amazon IoT SiteWise application is able to verify that it has connected to your trusted gateway.

In addition to TLS for secrecy and server authenticity, Sitewise Edge uses the SigV4 protocol to establish the authenticity of the edge console application. The Sitewise Edge connector on the gateway accepts and stores a password to be able to verify incoming connections from the edge console application, SiteWise Monitor application running within browsers, and other clients based on the Amazon IoT SiteWise SDK.

Data in transit between local components on gateways

Amazon IoT SiteWise gateways run on Amazon IoT Greengrass, which doesn't encrypt data exchanged locally on the Amazon IoT Greengrass core because the data doesn't leave the device. This includes communication between Amazon IoT Greengrass components such as the Amazon IoT SiteWise connector. For more information, see Data on the core device in the Amazon IoT Greengrass Version 1 Developer Guide.