View a markdown version of this page

Access control - Amazon IoT Core
Granting an Amazon IoT rule the access it requiresRevoking rule engine accessRestricting HTTP action traffic to the rules engine IPv6 ranges
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Access control

Granting an Amazon IoT rule the access it requires

Use IAM roles to control the Amazon resources to which each rule has access. Before you create a rule, you must create an IAM role with a policy that allows access to the required Amazon resources. Amazon IoT assumes this role when implementing a rule.

Complete the following steps to create the IAM role and Amazon IoT policy that grant an Amazon IoT rule the access it requires (Amazon CLI).

  1. Save the following trust policy document, which grants Amazon IoT permission to assume the role, to a file named iot-role-trust.json.

    {
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "iot.amazonaws.com"
        },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123456789012"
            },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws-cn:iot:us-east-1:123456789012:rule/rulename"
            }
        }
        }
    ]
}

    Use the create-role command to create an IAM role specifying the iot-role-trust.json file:

    aws iam create-role --role-name my-iot-role --assume-role-policy-document file://iot-role-trust.json

    The output of this command looks like the following:

    {
	"Role": {
		"AssumeRolePolicyDocument": "url-encoded-json",
		"RoleId": "AKIAIOSFODNN7EXAMPLE",
		"CreateDate": "2015-09-30T18:43:32.821Z",
		"RoleName": "my-iot-role",
		"Path": "/",
		"Arn": "arn:aws:iam::123456789012:role/my-iot-role"
	}
}

  2. Save the following JSON into a file named my-iot-policy.json.

    {
	"Version":"2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": "dynamodb:*",
			"Resource": "*"
		}
	]
}

    This JSON is an example policy document that grants Amazon IoT administrator access to DynamoDB.

    Use the create-policy command to grant Amazon IoT access to your Amazon resources upon assuming the role, passing in the my-iot-policy.json file:

    aws iam create-policy --policy-name my-iot-policy --policy-document file://my-iot-policy.json

    For more information about how to grant access to Amazon Web Services services in policies for Amazon IoT, see Creating an Amazon IoT rule.

    The output of the create-policy command contains the ARN of the policy. Attach the policy to a role.

    {
	"Policy": {
		"PolicyName": "my-iot-policy",
		"CreateDate": "2015-09-30T19:31:18.620Z",
		"AttachmentCount": 0,
		"IsAttachable": true,
		"PolicyId": "ZXR6A36LTYANPAI7NJ5UV",
		"DefaultVersionId": "v1",
		"Path": "/",
		"Arn": "arn:aws:iam::123456789012:policy/my-iot-policy",
		"UpdateDate": "2015-09-30T19:31:18.620Z"
	}
}

  3. Use the attach-role-policy command to attach your policy to your role:

    aws iam attach-role-policy --role-name my-iot-role --policy-arn "arn:aws:iam::123456789012:policy/my-iot-policy"

Revoking rule engine access

To immediately revoke rule engine access, do the following:

  1. Remove iot.amazonaws.com from the trust policy

  2. Follow the steps to revoke IAM role sessions

Restricting HTTP action traffic to the rules engine IPv6 ranges

Endpoints that restrict inbound traffic by source address must allow the range for your Region from the following table. This applies to HTTP action endpoints, which are the only destinations you can configure to be reachable over IPv6 only. For other actions, the rules engine connects to dual-stack destinations over IPv4, so there is no range to allow.

These ranges apply only when the rules engine connects to your endpoint over IPv6, which happens when your endpoint publishes AAAA records and no A records. There is no equivalent IPv4 range, so restricting rules engine traffic by source address requires an endpoint that's reachable only over IPv6.

Each range is used only for rules engine actions and doesn't change. Ranges for additional Regions are added to this table as they become available. For the steps to receive data over IPv6, see Network access.

Note

Regions not listed in this table don't have a rules engine IPv6 range.

Region IPv6 address range
us-east-1 2600:1f33:8000::/48
us-east-2 2600:1f33:6000::/48
us-west-1 2600:1f33:c000::/48
us-west-2 2600:1f33:4000::/48
ap-east-1 2406:da33:e000::/48
ap-northeast-1 2406:da33:4000::/48
ap-northeast-2 2406:da33:2000::/48
ap-south-1 2406:da33:a000::/48
ap-southeast-1 2406:da33:8000::/48
ap-southeast-2 2406:da33:c000::/48
ap-southeast-5 2406:da33:800::/48
ca-central-1 2600:1f33:1000::/48
eu-central-1 2a05:d033:4000::/48
eu-north-1 2a05:d033:6000::/48
eu-south-1 2a05:d033:a000::/48
eu-south-2 2a05:d033:1000::/48
eu-west-1 2a05:d033:8000::/48
eu-west-2 2a05:d033:c000::/48
eu-west-3 2a05:d033:2000::/48
il-central-1 2a05:d033:5000::/48
sa-east-1 2600:1f33:e000::/48
us-gov-east-1 2600:1f33:5000::/48
us-gov-west-1 2600:1f33:2000::/48

The following examples restrict inbound traffic to the us-east-1 range. Replace it with the range for your Region.

An API Gateway resource policy that allows the rules engine and denies everything else:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": "*",
			"Action": "execute-api:Invoke",
			"Resource": "execute-api:/*"
		},
		{
			"Effect": "Deny",
			"Principal": "*",
			"Action": "execute-api:Invoke",
			"Resource": "execute-api:/*",
			"Condition": {
				"NotIpAddress": {
					"aws:SourceIp": ["2600:1f33:8000::/48"]
				}
			}
		}
	]
}

For an endpoint behind a load balancer or on Amazon EC2, add an inbound rule to the security group that allows TCP traffic on port 443 from the range for your Region.