Setting up

Go to the Amazon Identity and Access Management console and log in to the Amazon Web Services account you use for Device Advisor testing.

In the left navigation pane, chose Policies.

Choose Create policy.

Under Create policy, do the following:

1. For Service, choose IoT.

2. Under Actions, do one of the following:

   • (Recommended) Select actions based on the policy attached to the IoT thing or certificate you created in the previous section.

   • Search for the following actions in the Filter action box and select them:

     • Connect

     • Publish

     • Subscribe

     • Receive

     • RetainPublish

3. Under Resources, restrict the client, topic, and topic resources. Restricting these resources is a security best practice. To restrict resources, do the following:

   1. Choose Specify client resource ARN for the Connect action.

   2. Choose Add ARN, then do either of the following:

      Note

      The clientId is the MQTT client ID that your device uses to interact with Device Advisor.

      • Specify the Region, accountID, and clientID in the visual ARN editor.

      • Manually enter the Amazon Resource Names (ARNs) of the IoT topics you want to run your test cases with.

   3. Choose Add.

   4. Choose Specify topic resource ARN for the Receive and one more action.

   5. Choose Add ARN, then do either of the following:

      Note

      The topic name is the MQTT topic that your device publishes messages to.

      • Specify the Region, accountID, and Topic name in the visual ARN editor.

      • Manually enter the ARNs of the IoT topics you want to run your test cases with.

   6. Choose Add.

   7. Choose Specify topicFilter resource ARN for the Subscribe action.

   8. Choose Add ARN, then do either of the following:

      Note

      The topic name is the MQTT topic that your device subscribes to.

      • Specify the Region, accountID, and Topic name in the visual ARN editor.

      • Manually enter the ARNs of the IoT topics you want to run your test cases with.

   9. Choose Add.

Choose Next: Tags.

Choose Next: Review.

Under Review policy, enter a Name for your policy.

Choose Create policy.

On the left navigation pane, Choose Roles.

Choose Create Role.

Under Select trusted entity, choose Custom trust policy.

Enter the following trust policy into the Custom trust policy box. To protect against the confused deputy problem, add the global condition context keys aws:SourceArn and aws:SourceAccount to the policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAwsIoTCoreDeviceAdvisor",
            "Effect": "Allow",
            "Principal": {
                "Service": "iotdeviceadvisor.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "111122223333"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:iotdeviceadvisor:*:111122223333:suitedefinition/*"
                }
            }
        }
    ]
}

Choose Next.

Choose the policy you created in Step 4.

(Optional) Under Set permissions boundary, choose Use a permissions boundary to control the maximum role permissions, and then select the policy you created.

Choose Next.

Enter a Role name and a Role description.

Choose Create role.

Navigate to the IAM console at https://console.amazonaws.cn/iam/. If prompted, enter your Amazon credentials to sign in.

In the left navigation pane, choose Policies.

Choose Create Policy, then choose the JSON tab.

Add the necessary permissions to use Device Advisor. The policy document can be found in the topic Security best practices.

Choose Review Policy.

Enter a Name and Description.

Choose Create Policy.

Navigate to the IAM console at https://console.amazonaws.cn/iam/ If prompted, enter your Amazon credentials to sign in.

In the left navigation pane, Choose Users.

Choose Add User.

Enter a User name.

Users need programmatic access if they want to interact with Amazon outside of the Amazon Web Services Management Console. The Amazon APIs and the Amazon Command Line Interface require access keys. Whenever possible, create temporary credentials that consist of an access key ID, a secret access key, and a security token that indicates when the credentials expire.

To grant users programmatic access, choose one of the following options.

Choose Next: Permissions.

To provide access, add permissions to your users, groups, or roles:

Enter the name of the custom-managed policy that you created in the search box. Then, select the check box for Policy name.

Choose Next: Tags.

Choose Next: Review.

Choose Create user.

Choose Close.