[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-iot":3,"mdc-z42hss-key":33,"related-repo-aws-labs-iot":3019,"related-org-aws-labs-iot":3117},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":28,"sourceUrl":31,"mdContent":32},"iot","design AWS IoT solutions and connectivity","Deep-dive into AWS IoT architecture, device connectivity, edge computing, and fleet management. This skill should be used when the user asks to \"design an IoT solution\", \"connect devices to AWS\", \"set up MQTT messaging\", \"configure IoT rules\", \"provision a device fleet\", \"use Greengrass at the edge\", \"build a device shadow\", \"set up IoT security\", \"manage OTA updates\", \"store telemetry data\", \"create IoT topic rules\", \"configure fleet provisioning\", or mentions IoT Core, MQTT, Greengrass, Device Shadow, IoT Rules Engine, IoT Events, IoT SiteWise, fleet indexing, or device certificates.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,16,19],{"name":14,"slug":4,"type":15},"IoT","tag",{"name":17,"slug":18,"type":15},"Infrastructure","infrastructure",{"name":20,"slug":21,"type":15},"AWS","aws",14,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups","2026-07-12T08:40:36.225644",null,15,[],{"repoUrl":23,"stars":22,"forks":26,"topics":29,"description":30},[],"Official AWS Startups repository that hosts plugins, skills, tools and resources to support startup builders on AWS","https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups\u002Ftree\u002FHEAD\u002Fsolution-architecture\u002Fplugins\u002Faws-dev-toolkit\u002Fskills\u002Fiot","---\nname: iot\ndescription: Deep-dive into AWS IoT architecture, device connectivity, edge computing, and fleet management. This skill should be used when the user asks to \"design an IoT solution\", \"connect devices to AWS\", \"set up MQTT messaging\", \"configure IoT rules\", \"provision a device fleet\", \"use Greengrass at the edge\", \"build a device shadow\", \"set up IoT security\", \"manage OTA updates\", \"store telemetry data\", \"create IoT topic rules\", \"configure fleet provisioning\", or mentions IoT Core, MQTT, Greengrass, Device Shadow, IoT Rules Engine, IoT Events, IoT SiteWise, fleet indexing, or device certificates.\n---\n\nSpecialist guidance for AWS IoT. Covers IoT Core (MQTT, shadows, rules engine), Greengrass v2 edge compute, fleet provisioning, security, data storage patterns, and fleet management.\n\n## Process\n\n1. Identify the IoT workload characteristics: device count, message frequency, payload size, connectivity (always-on vs intermittent), edge processing needs\n2. Use the `awsknowledge` MCP tools (`mcp__plugin_aws-dev-toolkit_awsknowledge__aws___search_documentation`, `mcp__plugin_aws-dev-toolkit_awsknowledge__aws___read_documentation`, `mcp__plugin_aws-dev-toolkit_awsknowledge__aws___recommend`) to verify current IoT Core limits, Greengrass component versions, and service quotas\n3. Select the appropriate IoT services using the decision matrix below\n4. Design the communication and data ingestion topology (protocols, topics, rules)\n5. Configure security (X.509 certificates, IoT policies, fleet provisioning method)\n6. Design data storage and analytics pipeline\n7. Plan fleet management (jobs, indexing, Device Defender)\n8. Recommend operational best practices (monitoring, OTA updates, edge deployments)\n\n## IoT Service Selection Decision Matrix\n\n| Requirement                                | Recommendation                 | Why                                                                                                                         |\n| ------------------------------------------ | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |\n| Devices sending telemetry to cloud         | IoT Core (MQTT)                | Persistent connections, sub-second latency, bidirectional, scales to millions of concurrent connections                     |\n| Request\u002Fresponse from constrained devices  | IoT Core (HTTPS)               | Stateless, no persistent connection needed, but higher latency and no server-to-device push                                 |\n| Browser or mobile app to IoT backend       | IoT Core (MQTT over WebSocket) | Works through firewalls\u002Fproxies, uses IAM or Cognito auth instead of X.509 certificates                                     |\n| Edge preprocessing before cloud upload     | Greengrass v2                  | Reduces bandwidth cost and cloud ingestion volume by filtering\u002Faggregating at the edge                                      |\n| Local device control when internet is down | Greengrass v2                  | Local MQTT broker keeps device-to-device communication working during cloud disconnection                                   |\n| Industrial OPC-UA data collection          | IoT SiteWise                   | Purpose-built for industrial protocols, asset modeling, and time-series with SiteWise Edge gateway                          |\n| State machine on device events             | IoT Events                     | Detector models react to patterns across multiple devices without custom Lambda logic                                       |\n| Time-series telemetry storage              | Timestream                     | Purpose-built for time-series with automatic tiering (memory to magnetic), built-in interpolation and aggregation functions |\n| Device metadata and state lookups          | DynamoDB                       | Single-digit ms latency for key-value access to device config, state, and registry data                                     |\n| Bulk telemetry archival                    | S3                             | Cheapest storage for raw telemetry; query with Athena when needed                                                           |\n| Telemetry search and dashboards            | OpenSearch                     | Full-text search and Kibana\u002FOpenSearch Dashboards for operational visibility                                                |\n\n## Protocol Selection\n\n### MQTT (Default Choice)\n\nUse MQTT for device-to-cloud communication unless there is a specific reason not to. MQTT uses persistent TCP connections with minimal overhead (2-byte header minimum), supports QoS 0 (at most once) and QoS 1 (at least once), and enables server-initiated push to devices via subscriptions.\n\n- **QoS 0**: Use for high-frequency telemetry where occasional message loss is acceptable (sensor readings every second). Lower overhead because no acknowledgment round-trip.\n- **QoS 1**: Use for commands, configuration changes, and alerts where delivery must be confirmed. The broker retries until PUBACK is received.\n- **QoS 2 is not supported** by AWS IoT Core. If exactly-once semantics are required, implement idempotency in the application layer.\n\n### MQTT v5 Features (Prefer When Devices Support It)\n\n- **Shared subscriptions**: Distribute messages across multiple subscribers for load balancing backend processors, avoiding hot-partition on a single consumer\n- **Topic aliases**: Replace long topic strings with short integer aliases after first publish, reducing per-message overhead for bandwidth-constrained devices\n- **Message expiry**: Set TTL on messages so stale commands are discarded rather than delivered to a device that reconnects hours later\n- **Session expiry**: Control how long the broker holds session state after disconnect, preventing unbounded memory growth from abandoned devices\n\n### HTTPS\n\nUse HTTPS only for devices that wake up, send a single reading, and sleep (battery-powered sensors with cellular connectivity). HTTPS does not support subscriptions, so the device cannot receive commands without polling. Every request incurs TLS handshake overhead.\n\n### MQTT over WebSocket\n\nUse for browser-based dashboards and mobile apps that need real-time device data. Authenticates with IAM credentials or Cognito identity pools instead of X.509 certificates. Works through corporate proxies and firewalls that block raw TCP on port 8883.\n\n## Topic Design\n\nDesign topics as a hierarchy with device identity and data type segments. This enables fine-grained IoT policy access control and targeted rules engine subscriptions.\n\n### Recommended Structure\n\n```\n{org}\u002F{environment}\u002F{device-type}\u002F{device-id}\u002F{data-category}\n```\n\nExamples:\n\n```\nacme\u002Fprod\u002Ftemperature-sensor\u002Fsensor-001\u002Ftelemetry\nacme\u002Fprod\u002Ftemperature-sensor\u002Fsensor-001\u002Falerts\nacme\u002Fprod\u002Ftemperature-sensor\u002Fsensor-001\u002Fcommands\nacme\u002Fprod\u002Ftemperature-sensor\u002F+\u002Ftelemetry        # Rule subscribes to all sensors\n```\n\n### Topic Design Rules\n\n- Include the device ID in the topic so IoT policies can use `${iot:Connection.Thing.ThingName}` to restrict each device to its own topics\n- Separate telemetry, commands, and alerts into distinct subtopics so rules can target specific data types without parsing payloads\n- Use `+` (single-level) and `#` (multi-level) wildcards in rules and subscriptions, never in publish topics\n- Keep topics under 7 levels deep to stay within IoT Core limits and maintain readability\n\n### Basic Ingest\n\nFor high-volume telemetry that goes directly to rules engine actions without needing the message broker, use the `$aws\u002Frules\u002F\u003Crule-name>` topic prefix. Basic Ingest skips the message broker publish cost ($1.00 per million messages), saving significant cost at scale. The tradeoff: messages sent via Basic Ingest cannot be received by other MQTT subscribers.\n\n## Device Shadow\n\nDevice Shadow maintains a JSON document of desired and reported state for each device. Use shadows when cloud applications need to read or set device state regardless of whether the device is currently connected.\n\n### Classic vs Named Shadows\n\n- **Classic shadow**: One per thing. Use for the primary device state (power on\u002Foff, firmware version, connectivity status).\n- **Named shadows**: Up to 10 per thing. Use to separate independent state concerns (e.g., one shadow for configuration, another for diagnostics, another for firmware). Named shadows avoid state conflicts when multiple applications update different aspects of the same device.\n\n### Shadow Best Practices\n\n- Keep shadow documents small (\u003C8 KB). Large shadows increase MQTT message size and DynamoDB read\u002Fwrite costs on the shadow service backend.\n- Use `reported` state from the device, `desired` state from the cloud application. The `delta` field tells the device what to change.\n- Set version-based optimistic locking on updates to prevent stale writes from overwriting newer state.\n\n## IoT Rules Engine\n\nThe rules engine evaluates SQL statements against incoming MQTT messages and routes matching data to AWS service actions. Every production deployment should have at least one rule for data ingestion and error handling.\n\n### Rule SQL Basics\n\n```sql\nSELECT temperature, humidity, timestamp() as ts, topic(4) as device_id\nFROM 'acme\u002Fprod\u002Ftemperature-sensor\u002F+\u002Ftelemetry'\nWHERE temperature > 0 AND temperature \u003C 150\n```\n\n- `topic(n)` extracts the nth level from the topic string (1-indexed)\n- `timestamp()` adds server-side UTC timestamp\n- `WHERE` clause filters before action execution, reducing downstream processing cost\n- Use `SELECT *` sparingly; extract only the fields needed to minimize action payload size\n\n### Action Selection Guide\n\n| Data Destination       | Rule Action           | When to Use                                                             |\n| ---------------------- | --------------------- | ----------------------------------------------------------------------- |\n| Real-time processing   | Lambda                | Custom transformation, enrichment, or fan-out logic                     |\n| Time-series storage    | Timestream            | Telemetry that needs time-range queries and aggregation                 |\n| Key-value lookups      | DynamoDB \u002F DynamoDBv2 | Device metadata, latest state, configuration                            |\n| Streaming analytics    | Kinesis Data Streams  | High-throughput ingestion for real-time analytics pipelines             |\n| Bulk archival          | S3                    | Raw telemetry archival for compliance or batch analytics                |\n| Notifications          | SNS                   | Alert routing to email, SMS, or HTTP endpoints                          |\n| Decoupled processing   | SQS                   | Buffer messages for downstream consumers that process at their own rate |\n| State machine triggers | IoT Events            | Multi-device event correlation and complex event processing             |\n| Republish              | IoT Core republish    | Route to another MQTT topic for device-to-device via cloud              |\n| Search and dashboards  | OpenSearch            | Operational dashboards and full-text search over telemetry              |\n\n### Error Actions (Always Configure)\n\nEvery rule must have an error action. Without one, failed rule actions silently drop data with no notification and no retry. Configure error actions to route failures to S3 or SQS for later reprocessing.\n\nSee `references\u002Frules-engine-patterns.md` for detailed SQL examples and error action configuration.\n\n## IoT SiteWise (Industrial IoT)\n\nUse IoT SiteWise instead of raw IoT Core + custom storage when the workload involves industrial equipment with OPC-UA data sources, asset hierarchies, and time-series metrics that need automatic aggregation (min, max, avg, count over time windows).\n\n### When to Use IoT SiteWise\n\n- Industrial environments with OPC-UA or Modbus data sources\n- Need for asset hierarchy modeling (factory > line > machine > sensor)\n- Pre-built portal\u002Fdashboard capabilities for operators (SiteWise Monitor)\n- Edge data collection and processing via SiteWise Edge gateway\n\n### When to Skip IoT SiteWise\n\n- Consumer IoT devices using MQTT natively (use IoT Core directly)\n- Custom data formats that do not fit the asset model structure\n- Workloads already using Timestream with custom dashboards (Grafana)\n\n## IoT Events\n\nUse IoT Events when device telemetry needs to trigger state-machine logic across multiple devices or time windows, and the logic is too complex for simple IoT Rules Engine WHERE clauses.\n\n### Detector Models\n\n- Define states (e.g., NORMAL, WARNING, CRITICAL) with transitions based on input conditions\n- Each detector instance tracks state for one device independently\n- Actions on state entry\u002Fexit\u002Ftransition: send SNS, publish to IoT Core, invoke Lambda, write to DynamoDB\n- Use for: equipment health monitoring, multi-sensor correlation, threshold-with-hysteresis alerting (avoid alert flapping by requiring sustained condition before state change)\n\n## Fleet Provisioning\n\n### Method Selection\n\n| Scenario                                              | Method                             | Why                                                                                                                                                                    |\n| ----------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| Factory installs unique certs per device              | JITP (Just-in-Time Provisioning)   | Simplest: device connects, CA is recognized, thing is auto-created. Requires trusted manufacturing chain.                                                              |\n| Factory installs unique certs, need custom validation | JITR (Just-in-Time Registration)   | Lambda hook validates additional attributes before activating the certificate                                                                                          |\n| Cannot install unique certs during manufacturing      | Fleet Provisioning by Claim        | Devices share a claim certificate, exchange it for a unique identity on first boot. Use pre-provisioning Lambda hook to validate serial numbers against an allow-list. |\n| End user or installer provisions device               | Fleet Provisioning by Trusted User | Mobile app generates temporary credentials for the device. Highest security for consumer devices.                                                                      |\n\n### Provisioning Best Practices\n\n- Always use a pre-provisioning Lambda hook with fleet provisioning by claim to validate the device identity against an allow-list. Without this, anyone with the claim certificate can provision unlimited devices.\n- Scope provisioning templates to create minimal IoT policies. The provisioned policy should grant access only to that device's topics, using `${iot:Connection.Thing.ThingName}` policy variables.\n- Store device private keys in hardware security modules (HSM) or secure elements when available. Software-stored keys are extractable.\n\nSee `references\u002Fsecurity-provisioning.md` for provisioning templates, certificate management, and IoT policy examples.\n\n## Security\n\n### X.509 Certificates\n\n- Every device must authenticate with a unique X.509 client certificate. Shared certificates across devices make revocation impossible without affecting the entire fleet.\n- Use AWS Private CA for production fleets. It provides automated certificate issuance, revocation (CRL), and integration with JITP.\n- Rotate certificates before expiry using IoT Jobs to push new certificates and a Lambda to register them. Expired certificates cause immediate connection failure with no grace period.\n\n### IoT Policies\n\nIoT policies control what MQTT topics a device can publish\u002Fsubscribe to and what shadows\u002Fjobs it can access. Always use policy variables to scope per-device.\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"iot:Connect\",\n      \"Resource\": \"arn:aws:iot:REGION:ACCOUNT:client\u002F${iot:Connection.Thing.ThingName}\"\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"iot:Publish\",\n      \"Resource\": \"arn:aws:iot:REGION:ACCOUNT:topic\u002Facme\u002Fprod\u002F*\u002F${iot:Connection.Thing.ThingName}\u002F*\"\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"iot:Subscribe\",\n      \"Resource\": \"arn:aws:iot:REGION:ACCOUNT:topicfilter\u002Facme\u002Fprod\u002F*\u002F${iot:Connection.Thing.ThingName}\u002F*\"\n    }\n  ]\n}\n```\n\n### Custom Authorizers\n\nUse custom authorizers when devices cannot use X.509 certificates (e.g., legacy devices with token-based auth or OAuth). The authorizer is a Lambda function that validates the token and returns an IoT policy document. Custom authorizers add latency (Lambda cold start) and cost (per-invocation), so prefer X.509 certificates for new device designs.\n\n### Device Defender\n\n- **Audit**: Scheduled checks for insecure configurations (overly permissive policies, shared certificates, disabled logging). Run at least weekly.\n- **Detect**: Real-time anomaly detection on device metrics (message volume, connection patterns, authorization failures). Alerts when a device deviates from its baseline behavior, indicating compromise or misconfiguration.\n- Configure mitigation actions to automatically quarantine compromised devices (move to a restricted thing group with minimal permissions).\n\n## Data Storage Patterns\n\n### Timestream (Time-Series Telemetry)\n\n- Default choice for telemetry that needs time-range queries (temperature over last 24 hours, average power per hour).\n- Automatic tiering: memory store (recent, fast queries) to magnetic store (historical, cheaper).\n- Set memory store retention to match your hot-query window (1-24 hours typical). Data beyond this moves to magnetic automatically.\n- Cost consideration: Timestream charges per write and per query scan. For very high-frequency telemetry (>1 msg\u002Fsec\u002Fdevice across thousands of devices), aggregate at the edge with Greengrass or use Basic Ingest to S3 with Athena for batch queries.\n\n### DynamoDB (Device Metadata and State)\n\n- Use for device registry extensions, latest-known state, configuration, and command history.\n- Design the partition key as the device ID for even distribution.\n- Use TTL to auto-expire old command records and reduce storage cost.\n- Do not store raw time-series telemetry in DynamoDB. At 1 msg\u002Fsec from 10,000 devices, that is 864 million writes\u002Fday, which costs roughly $1,100\u002Fday in on-demand WCU charges.\n\n### S3 (Bulk Archival)\n\n- Use IoT Rules Engine S3 action with partitioned keys: `s3:\u002F\u002Fbucket\u002Fyear=2026\u002Fmonth=04\u002Fday=06\u002Fhour=12\u002Fdevice-id.json`\n- Query archived data with Athena using partition projection for cost-effective ad-hoc analysis.\n- Enable S3 Intelligent-Tiering for automatic cost optimization on infrequently accessed telemetry.\n- Cheapest option for long-term retention and compliance requirements.\n\n### OpenSearch (Search and Analytics)\n\n- Use when operators need full-text search across telemetry fields or real-time dashboards.\n- IoT Rules Engine can write directly to OpenSearch Service.\n- Cost consideration: OpenSearch clusters run 24\u002F7 with dedicated instances. For intermittent analysis, prefer Athena on S3.\n\n## Greengrass v2 (Edge Compute)\n\n### When to Use Edge Compute\n\n- **Latency**: Local control loops that must respond in \u003C100ms (actuator control, safety shutoffs). Cloud round-trip adds 50-200ms minimum.\n- **Bandwidth**: Devices generate more data than the network can upload. Aggregate or filter at the edge, send summaries to cloud.\n- **Intermittent connectivity**: Sites with unreliable internet (remote oil wells, ships, mines). Greengrass buffers data and syncs when connected.\n- **Local ML inference**: Run ML models on edge hardware (image classification, anomaly detection) without sending raw data to cloud.\n\n### When to Skip Edge Compute\n\n- Devices with reliable, high-bandwidth connectivity and no latency requirements. Direct MQTT to IoT Core is simpler and eliminates edge infrastructure management.\n- Very constrained devices (microcontrollers with \u003C1MB RAM) that cannot run the Greengrass nucleus. Use FreeRTOS with direct IoT Core connectivity instead.\n\n### Component Model\n\nGreengrass v2 uses a component model where each capability is a deployable unit (recipe + artifacts). Components can be:\n\n- **AWS-provided**: Pre-built components for common tasks (stream manager, log manager, MQTT bridge, Docker application manager)\n- **Custom**: Your application logic, packaged as a recipe (YAML\u002FJSON) referencing artifacts (code, binaries, configs)\n- **Community**: Third-party components from the Greengrass component catalog\n\n### Stream Manager\n\nUse Stream Manager for reliable edge-to-cloud data transfer. It handles buffering, batching, bandwidth management, and automatic retry. Supports export to Kinesis Data Streams, S3, IoT Analytics, and IoT SiteWise.\n\n- Configure per-stream: storage type (memory or file-system), max size, strategy when full (reject new or overwrite oldest)\n- Set bandwidth limits to prevent telemetry uploads from starving control-plane traffic\n- Minimum 70 MB RAM overhead for the stream manager component\n\nSee `references\u002Fgreengrass-patterns.md` for component recipes, deployment configurations, and stream manager setup.\n\n## Fleet Management\n\n### IoT Jobs (OTA Updates)\n\n- Use Jobs for firmware updates, configuration changes, and certificate rotation across the fleet.\n- **Continuous jobs**: Automatically target new devices added to a thing group. Use for ongoing compliance (all devices in group X must have firmware v2.3+).\n- **Snapshot jobs**: One-time execution against a fixed set of targets.\n- Configure rollout rate (max devices per minute) and abort criteria (% failures before halting) to prevent fleet-wide bricking from a bad update.\n- Use signed job documents with code signing to prevent tampering.\n\n### Fleet Indexing\n\n- Enables SQL-like queries across device registry, shadow, connectivity, and Device Defender violation data.\n- Must be explicitly enabled (off by default). Without fleet indexing, you cannot query fleet state at scale.\n- Example: `thingName:sensor-* AND shadow.reported.firmware:v2.1 AND connectivity.connected:false` finds all disconnected sensors on old firmware.\n- Use fleet metrics to push aggregated fleet statistics to CloudWatch for dashboards and alarms.\n\n### Key Limits (IoT Core)\n\n| Resource                                              | Default Limit                  | Notes                |\n| ----------------------------------------------------- | ------------------------------ | -------------------- |\n| Maximum concurrent connections                        | 500,000 per account            | Requestable increase |\n| Maximum MQTT message size                             | 128 KB                         | Hard limit           |\n| Maximum publishes per second (per account)            | 20,000                         | Requestable increase |\n| Maximum inbound publishes per second (per connection) | 100                            | Per-device throttle  |\n| Persistent session expiry                             | 1 hour (default), up to 7 days | Configure per client |\n| Maximum rules per account                             | 1,000                          | Requestable increase |\n| Maximum actions per rule                              | 10                             | Hard limit           |\n| Maximum shadow document size                          | 8 KB (classic), 8 KB (named)   | Hard limit           |\n| Named shadows per thing                               | 10                             | Hard limit           |\n| Fleet provisioning templates per account              | 256                            | Requestable increase |\n| Thing groups depth                                    | 7 levels                       | Hard limit           |\n\n## Anti-Patterns\n\n- **Polling instead of MQTT.** Devices that HTTP poll for commands waste battery, bandwidth, and IoT Core request costs. A device polling every 5 seconds generates 17,280 requests\u002Fday; MQTT keeps a persistent connection with near-zero overhead when idle, and the server pushes commands instantly.\n- **No error actions on rules.** Without an error action, a failed rule action (IAM permission issue, DynamoDB throttle, Lambda error) silently drops the message. There is no retry, no alert, and no way to recover the data. Always route errors to S3 or SQS.\n- __Overly permissive IoT policies (iot:_ on _).__ A compromised device with `iot:*` can publish to any topic, read any shadow, and trigger any job. Use policy variables (`${iot:Connection.Thing.ThingName}`) to scope each device to its own resources.\n- **Single MQTT topic for all devices.** Publishing everything to `devices\u002Ftelemetry` makes it impossible to apply per-device access control, filter rules by device type, or subscribe to a specific device's data. Use hierarchical topics with device identity segments.\n- **Not using Device Shadow for desired\u002Freported state sync.** Without shadows, setting device state requires the device to be online at the exact moment the command is sent. Shadows persist the desired state and deliver it when the device reconnects.\n- **Storing raw telemetry in DynamoDB.** At IoT scale, DynamoDB write costs explode. 10,000 devices at 1 msg\u002Fsec = 864M writes\u002Fday = ~$1,100\u002Fday on-demand. Use Timestream for time-series (10-20x cheaper for write-heavy time-series workloads) or S3 for archival ($0.023\u002FGB\u002Fmonth).\n- **Ignoring Greengrass for edge preprocessing.** Sending raw high-frequency sensor data to the cloud wastes bandwidth and inflates ingestion costs. A Greengrass component that averages 1,000 readings into 1 summary per minute reduces cloud costs by 99.9%.\n- **Not configuring fleet indexing.** Without fleet indexing enabled, you cannot query which devices are running old firmware, which are disconnected, or which have specific shadow states. You are flying blind on fleet health. Enable it proactively.\n- **Shared X.509 certificates across devices.** If one device is compromised, you must revoke the shared certificate, disconnecting all devices that use it. One certificate per device limits the blast radius to a single device.\n- **No rollout controls on IoT Jobs.** Pushing a firmware update to all devices simultaneously risks fleet-wide failure. Always configure max concurrent targets, rollout rate, and abort thresholds (e.g., abort if >5% of devices fail).\n- **Ignoring Basic Ingest for high-volume telemetry.** Standard publish costs $1.00 per million messages. Basic Ingest ($0.00 publish cost, rules actions still charged) saves this entirely for telemetry that only needs to flow to rules engine actions.\n- **Not setting MQTT session expiry.** Default persistent session expiry is 1 hour. Devices that reconnect after longer disconnections lose queued messages. Set session expiry to match the device's expected offline duration (up to 7 days max).\n\n## Additional Resources\n\n### Reference Files\n\nFor detailed operational guidance, consult:\n\n- **`references\u002Frules-engine-patterns.md`** -- Rule SQL examples for common routing patterns, error action configuration, topic structure best practices, and Basic Ingest setup\n- **`references\u002Fsecurity-provisioning.md`** -- X.509 certificate management, fleet provisioning templates (JITP, bulk, by claim), IoT policies with variables, and custom authorizer setup\n- **`references\u002Fgreengrass-patterns.md`** -- Greengrass v2 component recipes, deployment configurations, stream manager setup, and local MQTT bridge configuration\n\n### Related Skills\n\n- **`lambda`** -- Lambda functions as IoT rule actions and Greengrass components\n- **`step-functions`** -- Orchestrating multi-step device provisioning and remediation workflows\n- **`dynamodb`** -- Device metadata storage design, partition key strategy, TTL configuration\n- **`s3`** -- Telemetry archival, lifecycle policies, Athena integration for batch queries\n- **`messaging`** -- SQS\u002FSNS integration with IoT rules for decoupled processing and alerting\n- **`observability`** -- CloudWatch metrics, alarms, and dashboards for IoT fleet monitoring\n- **`iam`** -- IAM roles for IoT rules engine actions, Greengrass token exchange, and fleet provisioning\n- **`networking`** -- VPC endpoints for IoT Core, private connectivity for Greengrass core devices\n- **`security-review`** -- Security audit of IoT policies, certificate management, and Device Defender configuration\n\n## Output Format\n\nWhen recommending an IoT architecture, include:\n\n| Component           | Choice                                                 | Rationale                                    |\n| ------------------- | ------------------------------------------------------ | -------------------------------------------- |\n| Protocol            | MQTT v5 over TLS 8883                                  | Bidirectional, persistent, low overhead      |\n| Authentication      | X.509 per-device certificates via AWS Private CA       | Hardware-bound identity, scalable revocation |\n| Provisioning        | Fleet Provisioning by Claim with pre-provisioning hook | Devices cannot be provisioned in factory     |\n| Topic Structure     | `{org}\u002Fprod\u002F{type}\u002F{device-id}\u002F{category}`             | Per-device access control, rule targeting    |\n| Telemetry Ingestion | IoT Rules Engine to Timestream (Basic Ingest)          | Cost-effective time-series storage           |\n| Device State        | Named Shadows (config + diagnostics)                   | Offline-tolerant desired\u002Freported sync       |\n| Edge Compute        | Greengrass v2 with Stream Manager                      | Local filtering, buffered cloud upload       |\n| Fleet Management    | Jobs (OTA) + Fleet Indexing + Device Defender          | Update, query, and audit the fleet           |\n| Alerting            | IoT Events detector model to SNS                       | Multi-device state correlation               |\n\nInclude estimated monthly cost range using the `cost-check` skill.\n",{"data":34,"body":35},{"name":4,"description":6},{"type":36,"children":37},"root",[38,46,53,130,136,366,372,379,384,419,425,468,474,479,485,490,496,501,507,519,524,533,539,586,592,605,611,616,622,645,651,692,698,703,709,747,795,801,1004,1010,1015,1028,1034,1039,1045,1068,1074,1092,1097,1102,1108,1131,1137,1143,1241,1247,1272,1284,1290,1296,1314,1320,1325,1804,1810,1815,1821,1849,1855,1861,1884,1890,1913,1919,1948,1954,1972,1978,1984,2027,2033,2046,2052,2057,2090,2096,2101,2119,2131,2137,2143,2181,2187,2218,2224,2440,2446,2603,2609,2615,2620,2662,2668,2797,2803,2808,3000,3013],{"type":39,"tag":40,"props":41,"children":42},"element","p",{},[43],{"type":44,"value":45},"text","Specialist guidance for AWS IoT. Covers IoT Core (MQTT, shadows, rules engine), Greengrass v2 edge compute, fleet provisioning, security, data storage patterns, and fleet management.",{"type":39,"tag":47,"props":48,"children":50},"h2",{"id":49},"process",[51],{"type":44,"value":52},"Process",{"type":39,"tag":54,"props":55,"children":56},"ol",{},[57,63,100,105,110,115,120,125],{"type":39,"tag":58,"props":59,"children":60},"li",{},[61],{"type":44,"value":62},"Identify the IoT workload characteristics: device count, message frequency, payload size, connectivity (always-on vs intermittent), edge processing needs",{"type":39,"tag":58,"props":64,"children":65},{},[66,68,75,77,83,85,91,92,98],{"type":44,"value":67},"Use the ",{"type":39,"tag":69,"props":70,"children":72},"code",{"className":71},[],[73],{"type":44,"value":74},"awsknowledge",{"type":44,"value":76}," MCP tools (",{"type":39,"tag":69,"props":78,"children":80},{"className":79},[],[81],{"type":44,"value":82},"mcp__plugin_aws-dev-toolkit_awsknowledge__aws___search_documentation",{"type":44,"value":84},", ",{"type":39,"tag":69,"props":86,"children":88},{"className":87},[],[89],{"type":44,"value":90},"mcp__plugin_aws-dev-toolkit_awsknowledge__aws___read_documentation",{"type":44,"value":84},{"type":39,"tag":69,"props":93,"children":95},{"className":94},[],[96],{"type":44,"value":97},"mcp__plugin_aws-dev-toolkit_awsknowledge__aws___recommend",{"type":44,"value":99},") to verify current IoT Core limits, Greengrass component versions, and service quotas",{"type":39,"tag":58,"props":101,"children":102},{},[103],{"type":44,"value":104},"Select the appropriate IoT services using the decision matrix below",{"type":39,"tag":58,"props":106,"children":107},{},[108],{"type":44,"value":109},"Design the communication and data ingestion topology (protocols, topics, rules)",{"type":39,"tag":58,"props":111,"children":112},{},[113],{"type":44,"value":114},"Configure security (X.509 certificates, IoT policies, fleet provisioning method)",{"type":39,"tag":58,"props":116,"children":117},{},[118],{"type":44,"value":119},"Design data storage and analytics pipeline",{"type":39,"tag":58,"props":121,"children":122},{},[123],{"type":44,"value":124},"Plan fleet management (jobs, indexing, Device Defender)",{"type":39,"tag":58,"props":126,"children":127},{},[128],{"type":44,"value":129},"Recommend operational best practices (monitoring, OTA updates, edge deployments)",{"type":39,"tag":47,"props":131,"children":133},{"id":132},"iot-service-selection-decision-matrix",[134],{"type":44,"value":135},"IoT Service Selection Decision Matrix",{"type":39,"tag":137,"props":138,"children":139},"table",{},[140,164],{"type":39,"tag":141,"props":142,"children":143},"thead",{},[144],{"type":39,"tag":145,"props":146,"children":147},"tr",{},[148,154,159],{"type":39,"tag":149,"props":150,"children":151},"th",{},[152],{"type":44,"value":153},"Requirement",{"type":39,"tag":149,"props":155,"children":156},{},[157],{"type":44,"value":158},"Recommendation",{"type":39,"tag":149,"props":160,"children":161},{},[162],{"type":44,"value":163},"Why",{"type":39,"tag":165,"props":166,"children":167},"tbody",{},[168,187,205,223,241,258,276,294,312,330,348],{"type":39,"tag":145,"props":169,"children":170},{},[171,177,182],{"type":39,"tag":172,"props":173,"children":174},"td",{},[175],{"type":44,"value":176},"Devices sending telemetry to cloud",{"type":39,"tag":172,"props":178,"children":179},{},[180],{"type":44,"value":181},"IoT Core (MQTT)",{"type":39,"tag":172,"props":183,"children":184},{},[185],{"type":44,"value":186},"Persistent connections, sub-second latency, bidirectional, scales to millions of concurrent connections",{"type":39,"tag":145,"props":188,"children":189},{},[190,195,200],{"type":39,"tag":172,"props":191,"children":192},{},[193],{"type":44,"value":194},"Request\u002Fresponse from constrained devices",{"type":39,"tag":172,"props":196,"children":197},{},[198],{"type":44,"value":199},"IoT Core (HTTPS)",{"type":39,"tag":172,"props":201,"children":202},{},[203],{"type":44,"value":204},"Stateless, no persistent connection needed, but higher latency and no server-to-device push",{"type":39,"tag":145,"props":206,"children":207},{},[208,213,218],{"type":39,"tag":172,"props":209,"children":210},{},[211],{"type":44,"value":212},"Browser or mobile app to IoT backend",{"type":39,"tag":172,"props":214,"children":215},{},[216],{"type":44,"value":217},"IoT Core (MQTT over WebSocket)",{"type":39,"tag":172,"props":219,"children":220},{},[221],{"type":44,"value":222},"Works through firewalls\u002Fproxies, uses IAM or Cognito auth instead of X.509 certificates",{"type":39,"tag":145,"props":224,"children":225},{},[226,231,236],{"type":39,"tag":172,"props":227,"children":228},{},[229],{"type":44,"value":230},"Edge preprocessing before cloud upload",{"type":39,"tag":172,"props":232,"children":233},{},[234],{"type":44,"value":235},"Greengrass v2",{"type":39,"tag":172,"props":237,"children":238},{},[239],{"type":44,"value":240},"Reduces bandwidth cost and cloud ingestion volume by filtering\u002Faggregating at the edge",{"type":39,"tag":145,"props":242,"children":243},{},[244,249,253],{"type":39,"tag":172,"props":245,"children":246},{},[247],{"type":44,"value":248},"Local device control when internet is down",{"type":39,"tag":172,"props":250,"children":251},{},[252],{"type":44,"value":235},{"type":39,"tag":172,"props":254,"children":255},{},[256],{"type":44,"value":257},"Local MQTT broker keeps device-to-device communication working during cloud disconnection",{"type":39,"tag":145,"props":259,"children":260},{},[261,266,271],{"type":39,"tag":172,"props":262,"children":263},{},[264],{"type":44,"value":265},"Industrial OPC-UA data collection",{"type":39,"tag":172,"props":267,"children":268},{},[269],{"type":44,"value":270},"IoT SiteWise",{"type":39,"tag":172,"props":272,"children":273},{},[274],{"type":44,"value":275},"Purpose-built for industrial protocols, asset modeling, and time-series with SiteWise Edge gateway",{"type":39,"tag":145,"props":277,"children":278},{},[279,284,289],{"type":39,"tag":172,"props":280,"children":281},{},[282],{"type":44,"value":283},"State machine on device events",{"type":39,"tag":172,"props":285,"children":286},{},[287],{"type":44,"value":288},"IoT Events",{"type":39,"tag":172,"props":290,"children":291},{},[292],{"type":44,"value":293},"Detector models react to patterns across multiple devices without custom Lambda logic",{"type":39,"tag":145,"props":295,"children":296},{},[297,302,307],{"type":39,"tag":172,"props":298,"children":299},{},[300],{"type":44,"value":301},"Time-series telemetry storage",{"type":39,"tag":172,"props":303,"children":304},{},[305],{"type":44,"value":306},"Timestream",{"type":39,"tag":172,"props":308,"children":309},{},[310],{"type":44,"value":311},"Purpose-built for time-series with automatic tiering (memory to magnetic), built-in interpolation and aggregation functions",{"type":39,"tag":145,"props":313,"children":314},{},[315,320,325],{"type":39,"tag":172,"props":316,"children":317},{},[318],{"type":44,"value":319},"Device metadata and state lookups",{"type":39,"tag":172,"props":321,"children":322},{},[323],{"type":44,"value":324},"DynamoDB",{"type":39,"tag":172,"props":326,"children":327},{},[328],{"type":44,"value":329},"Single-digit ms latency for key-value access to device config, state, and registry data",{"type":39,"tag":145,"props":331,"children":332},{},[333,338,343],{"type":39,"tag":172,"props":334,"children":335},{},[336],{"type":44,"value":337},"Bulk telemetry archival",{"type":39,"tag":172,"props":339,"children":340},{},[341],{"type":44,"value":342},"S3",{"type":39,"tag":172,"props":344,"children":345},{},[346],{"type":44,"value":347},"Cheapest storage for raw telemetry; query with Athena when needed",{"type":39,"tag":145,"props":349,"children":350},{},[351,356,361],{"type":39,"tag":172,"props":352,"children":353},{},[354],{"type":44,"value":355},"Telemetry search and dashboards",{"type":39,"tag":172,"props":357,"children":358},{},[359],{"type":44,"value":360},"OpenSearch",{"type":39,"tag":172,"props":362,"children":363},{},[364],{"type":44,"value":365},"Full-text search and Kibana\u002FOpenSearch Dashboards for operational visibility",{"type":39,"tag":47,"props":367,"children":369},{"id":368},"protocol-selection",[370],{"type":44,"value":371},"Protocol Selection",{"type":39,"tag":373,"props":374,"children":376},"h3",{"id":375},"mqtt-default-choice",[377],{"type":44,"value":378},"MQTT (Default Choice)",{"type":39,"tag":40,"props":380,"children":381},{},[382],{"type":44,"value":383},"Use MQTT for device-to-cloud communication unless there is a specific reason not to. MQTT uses persistent TCP connections with minimal overhead (2-byte header minimum), supports QoS 0 (at most once) and QoS 1 (at least once), and enables server-initiated push to devices via subscriptions.",{"type":39,"tag":385,"props":386,"children":387},"ul",{},[388,399,409],{"type":39,"tag":58,"props":389,"children":390},{},[391,397],{"type":39,"tag":392,"props":393,"children":394},"strong",{},[395],{"type":44,"value":396},"QoS 0",{"type":44,"value":398},": Use for high-frequency telemetry where occasional message loss is acceptable (sensor readings every second). Lower overhead because no acknowledgment round-trip.",{"type":39,"tag":58,"props":400,"children":401},{},[402,407],{"type":39,"tag":392,"props":403,"children":404},{},[405],{"type":44,"value":406},"QoS 1",{"type":44,"value":408},": Use for commands, configuration changes, and alerts where delivery must be confirmed. The broker retries until PUBACK is received.",{"type":39,"tag":58,"props":410,"children":411},{},[412,417],{"type":39,"tag":392,"props":413,"children":414},{},[415],{"type":44,"value":416},"QoS 2 is not supported",{"type":44,"value":418}," by AWS IoT Core. If exactly-once semantics are required, implement idempotency in the application layer.",{"type":39,"tag":373,"props":420,"children":422},{"id":421},"mqtt-v5-features-prefer-when-devices-support-it",[423],{"type":44,"value":424},"MQTT v5 Features (Prefer When Devices Support It)",{"type":39,"tag":385,"props":426,"children":427},{},[428,438,448,458],{"type":39,"tag":58,"props":429,"children":430},{},[431,436],{"type":39,"tag":392,"props":432,"children":433},{},[434],{"type":44,"value":435},"Shared subscriptions",{"type":44,"value":437},": Distribute messages across multiple subscribers for load balancing backend processors, avoiding hot-partition on a single consumer",{"type":39,"tag":58,"props":439,"children":440},{},[441,446],{"type":39,"tag":392,"props":442,"children":443},{},[444],{"type":44,"value":445},"Topic aliases",{"type":44,"value":447},": Replace long topic strings with short integer aliases after first publish, reducing per-message overhead for bandwidth-constrained devices",{"type":39,"tag":58,"props":449,"children":450},{},[451,456],{"type":39,"tag":392,"props":452,"children":453},{},[454],{"type":44,"value":455},"Message expiry",{"type":44,"value":457},": Set TTL on messages so stale commands are discarded rather than delivered to a device that reconnects hours later",{"type":39,"tag":58,"props":459,"children":460},{},[461,466],{"type":39,"tag":392,"props":462,"children":463},{},[464],{"type":44,"value":465},"Session expiry",{"type":44,"value":467},": Control how long the broker holds session state after disconnect, preventing unbounded memory growth from abandoned devices",{"type":39,"tag":373,"props":469,"children":471},{"id":470},"https",[472],{"type":44,"value":473},"HTTPS",{"type":39,"tag":40,"props":475,"children":476},{},[477],{"type":44,"value":478},"Use HTTPS only for devices that wake up, send a single reading, and sleep (battery-powered sensors with cellular connectivity). HTTPS does not support subscriptions, so the device cannot receive commands without polling. Every request incurs TLS handshake overhead.",{"type":39,"tag":373,"props":480,"children":482},{"id":481},"mqtt-over-websocket",[483],{"type":44,"value":484},"MQTT over WebSocket",{"type":39,"tag":40,"props":486,"children":487},{},[488],{"type":44,"value":489},"Use for browser-based dashboards and mobile apps that need real-time device data. Authenticates with IAM credentials or Cognito identity pools instead of X.509 certificates. Works through corporate proxies and firewalls that block raw TCP on port 8883.",{"type":39,"tag":47,"props":491,"children":493},{"id":492},"topic-design",[494],{"type":44,"value":495},"Topic Design",{"type":39,"tag":40,"props":497,"children":498},{},[499],{"type":44,"value":500},"Design topics as a hierarchy with device identity and data type segments. This enables fine-grained IoT policy access control and targeted rules engine subscriptions.",{"type":39,"tag":373,"props":502,"children":504},{"id":503},"recommended-structure",[505],{"type":44,"value":506},"Recommended Structure",{"type":39,"tag":508,"props":509,"children":513},"pre",{"className":510,"code":512,"language":44},[511],"language-text","{org}\u002F{environment}\u002F{device-type}\u002F{device-id}\u002F{data-category}\n",[514],{"type":39,"tag":69,"props":515,"children":517},{"__ignoreMap":516},"",[518],{"type":44,"value":512},{"type":39,"tag":40,"props":520,"children":521},{},[522],{"type":44,"value":523},"Examples:",{"type":39,"tag":508,"props":525,"children":528},{"className":526,"code":527,"language":44},[511],"acme\u002Fprod\u002Ftemperature-sensor\u002Fsensor-001\u002Ftelemetry\nacme\u002Fprod\u002Ftemperature-sensor\u002Fsensor-001\u002Falerts\nacme\u002Fprod\u002Ftemperature-sensor\u002Fsensor-001\u002Fcommands\nacme\u002Fprod\u002Ftemperature-sensor\u002F+\u002Ftelemetry        # Rule subscribes to all sensors\n",[529],{"type":39,"tag":69,"props":530,"children":531},{"__ignoreMap":516},[532],{"type":44,"value":527},{"type":39,"tag":373,"props":534,"children":536},{"id":535},"topic-design-rules",[537],{"type":44,"value":538},"Topic Design Rules",{"type":39,"tag":385,"props":540,"children":541},{},[542,555,560,581],{"type":39,"tag":58,"props":543,"children":544},{},[545,547,553],{"type":44,"value":546},"Include the device ID in the topic so IoT policies can use ",{"type":39,"tag":69,"props":548,"children":550},{"className":549},[],[551],{"type":44,"value":552},"${iot:Connection.Thing.ThingName}",{"type":44,"value":554}," to restrict each device to its own topics",{"type":39,"tag":58,"props":556,"children":557},{},[558],{"type":44,"value":559},"Separate telemetry, commands, and alerts into distinct subtopics so rules can target specific data types without parsing payloads",{"type":39,"tag":58,"props":561,"children":562},{},[563,565,571,573,579],{"type":44,"value":564},"Use ",{"type":39,"tag":69,"props":566,"children":568},{"className":567},[],[569],{"type":44,"value":570},"+",{"type":44,"value":572}," (single-level) and ",{"type":39,"tag":69,"props":574,"children":576},{"className":575},[],[577],{"type":44,"value":578},"#",{"type":44,"value":580}," (multi-level) wildcards in rules and subscriptions, never in publish topics",{"type":39,"tag":58,"props":582,"children":583},{},[584],{"type":44,"value":585},"Keep topics under 7 levels deep to stay within IoT Core limits and maintain readability",{"type":39,"tag":373,"props":587,"children":589},{"id":588},"basic-ingest",[590],{"type":44,"value":591},"Basic Ingest",{"type":39,"tag":40,"props":593,"children":594},{},[595,597,603],{"type":44,"value":596},"For high-volume telemetry that goes directly to rules engine actions without needing the message broker, use the ",{"type":39,"tag":69,"props":598,"children":600},{"className":599},[],[601],{"type":44,"value":602},"$aws\u002Frules\u002F\u003Crule-name>",{"type":44,"value":604}," topic prefix. Basic Ingest skips the message broker publish cost ($1.00 per million messages), saving significant cost at scale. The tradeoff: messages sent via Basic Ingest cannot be received by other MQTT subscribers.",{"type":39,"tag":47,"props":606,"children":608},{"id":607},"device-shadow",[609],{"type":44,"value":610},"Device Shadow",{"type":39,"tag":40,"props":612,"children":613},{},[614],{"type":44,"value":615},"Device Shadow maintains a JSON document of desired and reported state for each device. Use shadows when cloud applications need to read or set device state regardless of whether the device is currently connected.",{"type":39,"tag":373,"props":617,"children":619},{"id":618},"classic-vs-named-shadows",[620],{"type":44,"value":621},"Classic vs Named Shadows",{"type":39,"tag":385,"props":623,"children":624},{},[625,635],{"type":39,"tag":58,"props":626,"children":627},{},[628,633],{"type":39,"tag":392,"props":629,"children":630},{},[631],{"type":44,"value":632},"Classic shadow",{"type":44,"value":634},": One per thing. Use for the primary device state (power on\u002Foff, firmware version, connectivity status).",{"type":39,"tag":58,"props":636,"children":637},{},[638,643],{"type":39,"tag":392,"props":639,"children":640},{},[641],{"type":44,"value":642},"Named shadows",{"type":44,"value":644},": Up to 10 per thing. Use to separate independent state concerns (e.g., one shadow for configuration, another for diagnostics, another for firmware). Named shadows avoid state conflicts when multiple applications update different aspects of the same device.",{"type":39,"tag":373,"props":646,"children":648},{"id":647},"shadow-best-practices",[649],{"type":44,"value":650},"Shadow Best Practices",{"type":39,"tag":385,"props":652,"children":653},{},[654,659,687],{"type":39,"tag":58,"props":655,"children":656},{},[657],{"type":44,"value":658},"Keep shadow documents small (\u003C8 KB). Large shadows increase MQTT message size and DynamoDB read\u002Fwrite costs on the shadow service backend.",{"type":39,"tag":58,"props":660,"children":661},{},[662,663,669,671,677,679,685],{"type":44,"value":564},{"type":39,"tag":69,"props":664,"children":666},{"className":665},[],[667],{"type":44,"value":668},"reported",{"type":44,"value":670}," state from the device, ",{"type":39,"tag":69,"props":672,"children":674},{"className":673},[],[675],{"type":44,"value":676},"desired",{"type":44,"value":678}," state from the cloud application. The ",{"type":39,"tag":69,"props":680,"children":682},{"className":681},[],[683],{"type":44,"value":684},"delta",{"type":44,"value":686}," field tells the device what to change.",{"type":39,"tag":58,"props":688,"children":689},{},[690],{"type":44,"value":691},"Set version-based optimistic locking on updates to prevent stale writes from overwriting newer state.",{"type":39,"tag":47,"props":693,"children":695},{"id":694},"iot-rules-engine",[696],{"type":44,"value":697},"IoT Rules Engine",{"type":39,"tag":40,"props":699,"children":700},{},[701],{"type":44,"value":702},"The rules engine evaluates SQL statements against incoming MQTT messages and routes matching data to AWS service actions. Every production deployment should have at least one rule for data ingestion and error handling.",{"type":39,"tag":373,"props":704,"children":706},{"id":705},"rule-sql-basics",[707],{"type":44,"value":708},"Rule SQL Basics",{"type":39,"tag":508,"props":710,"children":714},{"className":711,"code":712,"language":713,"meta":516,"style":516},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","SELECT temperature, humidity, timestamp() as ts, topic(4) as device_id\nFROM 'acme\u002Fprod\u002Ftemperature-sensor\u002F+\u002Ftelemetry'\nWHERE temperature > 0 AND temperature \u003C 150\n","sql",[715],{"type":39,"tag":69,"props":716,"children":717},{"__ignoreMap":516},[718,729,738],{"type":39,"tag":719,"props":720,"children":723},"span",{"class":721,"line":722},"line",1,[724],{"type":39,"tag":719,"props":725,"children":726},{},[727],{"type":44,"value":728},"SELECT temperature, humidity, timestamp() as ts, topic(4) as device_id\n",{"type":39,"tag":719,"props":730,"children":732},{"class":721,"line":731},2,[733],{"type":39,"tag":719,"props":734,"children":735},{},[736],{"type":44,"value":737},"FROM 'acme\u002Fprod\u002Ftemperature-sensor\u002F+\u002Ftelemetry'\n",{"type":39,"tag":719,"props":739,"children":741},{"class":721,"line":740},3,[742],{"type":39,"tag":719,"props":743,"children":744},{},[745],{"type":44,"value":746},"WHERE temperature > 0 AND temperature \u003C 150\n",{"type":39,"tag":385,"props":748,"children":749},{},[750,761,772,783],{"type":39,"tag":58,"props":751,"children":752},{},[753,759],{"type":39,"tag":69,"props":754,"children":756},{"className":755},[],[757],{"type":44,"value":758},"topic(n)",{"type":44,"value":760}," extracts the nth level from the topic string (1-indexed)",{"type":39,"tag":58,"props":762,"children":763},{},[764,770],{"type":39,"tag":69,"props":765,"children":767},{"className":766},[],[768],{"type":44,"value":769},"timestamp()",{"type":44,"value":771}," adds server-side UTC timestamp",{"type":39,"tag":58,"props":773,"children":774},{},[775,781],{"type":39,"tag":69,"props":776,"children":778},{"className":777},[],[779],{"type":44,"value":780},"WHERE",{"type":44,"value":782}," clause filters before action execution, reducing downstream processing cost",{"type":39,"tag":58,"props":784,"children":785},{},[786,787,793],{"type":44,"value":564},{"type":39,"tag":69,"props":788,"children":790},{"className":789},[],[791],{"type":44,"value":792},"SELECT *",{"type":44,"value":794}," sparingly; extract only the fields needed to minimize action payload size",{"type":39,"tag":373,"props":796,"children":798},{"id":797},"action-selection-guide",[799],{"type":44,"value":800},"Action Selection Guide",{"type":39,"tag":137,"props":802,"children":803},{},[804,825],{"type":39,"tag":141,"props":805,"children":806},{},[807],{"type":39,"tag":145,"props":808,"children":809},{},[810,815,820],{"type":39,"tag":149,"props":811,"children":812},{},[813],{"type":44,"value":814},"Data Destination",{"type":39,"tag":149,"props":816,"children":817},{},[818],{"type":44,"value":819},"Rule Action",{"type":39,"tag":149,"props":821,"children":822},{},[823],{"type":44,"value":824},"When to Use",{"type":39,"tag":165,"props":826,"children":827},{},[828,846,863,881,899,916,934,952,969,987],{"type":39,"tag":145,"props":829,"children":830},{},[831,836,841],{"type":39,"tag":172,"props":832,"children":833},{},[834],{"type":44,"value":835},"Real-time processing",{"type":39,"tag":172,"props":837,"children":838},{},[839],{"type":44,"value":840},"Lambda",{"type":39,"tag":172,"props":842,"children":843},{},[844],{"type":44,"value":845},"Custom transformation, enrichment, or fan-out logic",{"type":39,"tag":145,"props":847,"children":848},{},[849,854,858],{"type":39,"tag":172,"props":850,"children":851},{},[852],{"type":44,"value":853},"Time-series storage",{"type":39,"tag":172,"props":855,"children":856},{},[857],{"type":44,"value":306},{"type":39,"tag":172,"props":859,"children":860},{},[861],{"type":44,"value":862},"Telemetry that needs time-range queries and aggregation",{"type":39,"tag":145,"props":864,"children":865},{},[866,871,876],{"type":39,"tag":172,"props":867,"children":868},{},[869],{"type":44,"value":870},"Key-value lookups",{"type":39,"tag":172,"props":872,"children":873},{},[874],{"type":44,"value":875},"DynamoDB \u002F DynamoDBv2",{"type":39,"tag":172,"props":877,"children":878},{},[879],{"type":44,"value":880},"Device metadata, latest state, configuration",{"type":39,"tag":145,"props":882,"children":883},{},[884,889,894],{"type":39,"tag":172,"props":885,"children":886},{},[887],{"type":44,"value":888},"Streaming analytics",{"type":39,"tag":172,"props":890,"children":891},{},[892],{"type":44,"value":893},"Kinesis Data Streams",{"type":39,"tag":172,"props":895,"children":896},{},[897],{"type":44,"value":898},"High-throughput ingestion for real-time analytics pipelines",{"type":39,"tag":145,"props":900,"children":901},{},[902,907,911],{"type":39,"tag":172,"props":903,"children":904},{},[905],{"type":44,"value":906},"Bulk archival",{"type":39,"tag":172,"props":908,"children":909},{},[910],{"type":44,"value":342},{"type":39,"tag":172,"props":912,"children":913},{},[914],{"type":44,"value":915},"Raw telemetry archival for compliance or batch analytics",{"type":39,"tag":145,"props":917,"children":918},{},[919,924,929],{"type":39,"tag":172,"props":920,"children":921},{},[922],{"type":44,"value":923},"Notifications",{"type":39,"tag":172,"props":925,"children":926},{},[927],{"type":44,"value":928},"SNS",{"type":39,"tag":172,"props":930,"children":931},{},[932],{"type":44,"value":933},"Alert routing to email, SMS, or HTTP endpoints",{"type":39,"tag":145,"props":935,"children":936},{},[937,942,947],{"type":39,"tag":172,"props":938,"children":939},{},[940],{"type":44,"value":941},"Decoupled processing",{"type":39,"tag":172,"props":943,"children":944},{},[945],{"type":44,"value":946},"SQS",{"type":39,"tag":172,"props":948,"children":949},{},[950],{"type":44,"value":951},"Buffer messages for downstream consumers that process at their own rate",{"type":39,"tag":145,"props":953,"children":954},{},[955,960,964],{"type":39,"tag":172,"props":956,"children":957},{},[958],{"type":44,"value":959},"State machine triggers",{"type":39,"tag":172,"props":961,"children":962},{},[963],{"type":44,"value":288},{"type":39,"tag":172,"props":965,"children":966},{},[967],{"type":44,"value":968},"Multi-device event correlation and complex event processing",{"type":39,"tag":145,"props":970,"children":971},{},[972,977,982],{"type":39,"tag":172,"props":973,"children":974},{},[975],{"type":44,"value":976},"Republish",{"type":39,"tag":172,"props":978,"children":979},{},[980],{"type":44,"value":981},"IoT Core republish",{"type":39,"tag":172,"props":983,"children":984},{},[985],{"type":44,"value":986},"Route to another MQTT topic for device-to-device via cloud",{"type":39,"tag":145,"props":988,"children":989},{},[990,995,999],{"type":39,"tag":172,"props":991,"children":992},{},[993],{"type":44,"value":994},"Search and dashboards",{"type":39,"tag":172,"props":996,"children":997},{},[998],{"type":44,"value":360},{"type":39,"tag":172,"props":1000,"children":1001},{},[1002],{"type":44,"value":1003},"Operational dashboards and full-text search over telemetry",{"type":39,"tag":373,"props":1005,"children":1007},{"id":1006},"error-actions-always-configure",[1008],{"type":44,"value":1009},"Error Actions (Always Configure)",{"type":39,"tag":40,"props":1011,"children":1012},{},[1013],{"type":44,"value":1014},"Every rule must have an error action. Without one, failed rule actions silently drop data with no notification and no retry. Configure error actions to route failures to S3 or SQS for later reprocessing.",{"type":39,"tag":40,"props":1016,"children":1017},{},[1018,1020,1026],{"type":44,"value":1019},"See ",{"type":39,"tag":69,"props":1021,"children":1023},{"className":1022},[],[1024],{"type":44,"value":1025},"references\u002Frules-engine-patterns.md",{"type":44,"value":1027}," for detailed SQL examples and error action configuration.",{"type":39,"tag":47,"props":1029,"children":1031},{"id":1030},"iot-sitewise-industrial-iot",[1032],{"type":44,"value":1033},"IoT SiteWise (Industrial IoT)",{"type":39,"tag":40,"props":1035,"children":1036},{},[1037],{"type":44,"value":1038},"Use IoT SiteWise instead of raw IoT Core + custom storage when the workload involves industrial equipment with OPC-UA data sources, asset hierarchies, and time-series metrics that need automatic aggregation (min, max, avg, count over time windows).",{"type":39,"tag":373,"props":1040,"children":1042},{"id":1041},"when-to-use-iot-sitewise",[1043],{"type":44,"value":1044},"When to Use IoT SiteWise",{"type":39,"tag":385,"props":1046,"children":1047},{},[1048,1053,1058,1063],{"type":39,"tag":58,"props":1049,"children":1050},{},[1051],{"type":44,"value":1052},"Industrial environments with OPC-UA or Modbus data sources",{"type":39,"tag":58,"props":1054,"children":1055},{},[1056],{"type":44,"value":1057},"Need for asset hierarchy modeling (factory > line > machine > sensor)",{"type":39,"tag":58,"props":1059,"children":1060},{},[1061],{"type":44,"value":1062},"Pre-built portal\u002Fdashboard capabilities for operators (SiteWise Monitor)",{"type":39,"tag":58,"props":1064,"children":1065},{},[1066],{"type":44,"value":1067},"Edge data collection and processing via SiteWise Edge gateway",{"type":39,"tag":373,"props":1069,"children":1071},{"id":1070},"when-to-skip-iot-sitewise",[1072],{"type":44,"value":1073},"When to Skip IoT SiteWise",{"type":39,"tag":385,"props":1075,"children":1076},{},[1077,1082,1087],{"type":39,"tag":58,"props":1078,"children":1079},{},[1080],{"type":44,"value":1081},"Consumer IoT devices using MQTT natively (use IoT Core directly)",{"type":39,"tag":58,"props":1083,"children":1084},{},[1085],{"type":44,"value":1086},"Custom data formats that do not fit the asset model structure",{"type":39,"tag":58,"props":1088,"children":1089},{},[1090],{"type":44,"value":1091},"Workloads already using Timestream with custom dashboards (Grafana)",{"type":39,"tag":47,"props":1093,"children":1095},{"id":1094},"iot-events",[1096],{"type":44,"value":288},{"type":39,"tag":40,"props":1098,"children":1099},{},[1100],{"type":44,"value":1101},"Use IoT Events when device telemetry needs to trigger state-machine logic across multiple devices or time windows, and the logic is too complex for simple IoT Rules Engine WHERE clauses.",{"type":39,"tag":373,"props":1103,"children":1105},{"id":1104},"detector-models",[1106],{"type":44,"value":1107},"Detector Models",{"type":39,"tag":385,"props":1109,"children":1110},{},[1111,1116,1121,1126],{"type":39,"tag":58,"props":1112,"children":1113},{},[1114],{"type":44,"value":1115},"Define states (e.g., NORMAL, WARNING, CRITICAL) with transitions based on input conditions",{"type":39,"tag":58,"props":1117,"children":1118},{},[1119],{"type":44,"value":1120},"Each detector instance tracks state for one device independently",{"type":39,"tag":58,"props":1122,"children":1123},{},[1124],{"type":44,"value":1125},"Actions on state entry\u002Fexit\u002Ftransition: send SNS, publish to IoT Core, invoke Lambda, write to DynamoDB",{"type":39,"tag":58,"props":1127,"children":1128},{},[1129],{"type":44,"value":1130},"Use for: equipment health monitoring, multi-sensor correlation, threshold-with-hysteresis alerting (avoid alert flapping by requiring sustained condition before state change)",{"type":39,"tag":47,"props":1132,"children":1134},{"id":1133},"fleet-provisioning",[1135],{"type":44,"value":1136},"Fleet Provisioning",{"type":39,"tag":373,"props":1138,"children":1140},{"id":1139},"method-selection",[1141],{"type":44,"value":1142},"Method Selection",{"type":39,"tag":137,"props":1144,"children":1145},{},[1146,1166],{"type":39,"tag":141,"props":1147,"children":1148},{},[1149],{"type":39,"tag":145,"props":1150,"children":1151},{},[1152,1157,1162],{"type":39,"tag":149,"props":1153,"children":1154},{},[1155],{"type":44,"value":1156},"Scenario",{"type":39,"tag":149,"props":1158,"children":1159},{},[1160],{"type":44,"value":1161},"Method",{"type":39,"tag":149,"props":1163,"children":1164},{},[1165],{"type":44,"value":163},{"type":39,"tag":165,"props":1167,"children":1168},{},[1169,1187,1205,1223],{"type":39,"tag":145,"props":1170,"children":1171},{},[1172,1177,1182],{"type":39,"tag":172,"props":1173,"children":1174},{},[1175],{"type":44,"value":1176},"Factory installs unique certs per device",{"type":39,"tag":172,"props":1178,"children":1179},{},[1180],{"type":44,"value":1181},"JITP (Just-in-Time Provisioning)",{"type":39,"tag":172,"props":1183,"children":1184},{},[1185],{"type":44,"value":1186},"Simplest: device connects, CA is recognized, thing is auto-created. Requires trusted manufacturing chain.",{"type":39,"tag":145,"props":1188,"children":1189},{},[1190,1195,1200],{"type":39,"tag":172,"props":1191,"children":1192},{},[1193],{"type":44,"value":1194},"Factory installs unique certs, need custom validation",{"type":39,"tag":172,"props":1196,"children":1197},{},[1198],{"type":44,"value":1199},"JITR (Just-in-Time Registration)",{"type":39,"tag":172,"props":1201,"children":1202},{},[1203],{"type":44,"value":1204},"Lambda hook validates additional attributes before activating the certificate",{"type":39,"tag":145,"props":1206,"children":1207},{},[1208,1213,1218],{"type":39,"tag":172,"props":1209,"children":1210},{},[1211],{"type":44,"value":1212},"Cannot install unique certs during manufacturing",{"type":39,"tag":172,"props":1214,"children":1215},{},[1216],{"type":44,"value":1217},"Fleet Provisioning by Claim",{"type":39,"tag":172,"props":1219,"children":1220},{},[1221],{"type":44,"value":1222},"Devices share a claim certificate, exchange it for a unique identity on first boot. Use pre-provisioning Lambda hook to validate serial numbers against an allow-list.",{"type":39,"tag":145,"props":1224,"children":1225},{},[1226,1231,1236],{"type":39,"tag":172,"props":1227,"children":1228},{},[1229],{"type":44,"value":1230},"End user or installer provisions device",{"type":39,"tag":172,"props":1232,"children":1233},{},[1234],{"type":44,"value":1235},"Fleet Provisioning by Trusted User",{"type":39,"tag":172,"props":1237,"children":1238},{},[1239],{"type":44,"value":1240},"Mobile app generates temporary credentials for the device. Highest security for consumer devices.",{"type":39,"tag":373,"props":1242,"children":1244},{"id":1243},"provisioning-best-practices",[1245],{"type":44,"value":1246},"Provisioning Best Practices",{"type":39,"tag":385,"props":1248,"children":1249},{},[1250,1255,1267],{"type":39,"tag":58,"props":1251,"children":1252},{},[1253],{"type":44,"value":1254},"Always use a pre-provisioning Lambda hook with fleet provisioning by claim to validate the device identity against an allow-list. Without this, anyone with the claim certificate can provision unlimited devices.",{"type":39,"tag":58,"props":1256,"children":1257},{},[1258,1260,1265],{"type":44,"value":1259},"Scope provisioning templates to create minimal IoT policies. The provisioned policy should grant access only to that device's topics, using ",{"type":39,"tag":69,"props":1261,"children":1263},{"className":1262},[],[1264],{"type":44,"value":552},{"type":44,"value":1266}," policy variables.",{"type":39,"tag":58,"props":1268,"children":1269},{},[1270],{"type":44,"value":1271},"Store device private keys in hardware security modules (HSM) or secure elements when available. Software-stored keys are extractable.",{"type":39,"tag":40,"props":1273,"children":1274},{},[1275,1276,1282],{"type":44,"value":1019},{"type":39,"tag":69,"props":1277,"children":1279},{"className":1278},[],[1280],{"type":44,"value":1281},"references\u002Fsecurity-provisioning.md",{"type":44,"value":1283}," for provisioning templates, certificate management, and IoT policy examples.",{"type":39,"tag":47,"props":1285,"children":1287},{"id":1286},"security",[1288],{"type":44,"value":1289},"Security",{"type":39,"tag":373,"props":1291,"children":1293},{"id":1292},"x509-certificates",[1294],{"type":44,"value":1295},"X.509 Certificates",{"type":39,"tag":385,"props":1297,"children":1298},{},[1299,1304,1309],{"type":39,"tag":58,"props":1300,"children":1301},{},[1302],{"type":44,"value":1303},"Every device must authenticate with a unique X.509 client certificate. Shared certificates across devices make revocation impossible without affecting the entire fleet.",{"type":39,"tag":58,"props":1305,"children":1306},{},[1307],{"type":44,"value":1308},"Use AWS Private CA for production fleets. It provides automated certificate issuance, revocation (CRL), and integration with JITP.",{"type":39,"tag":58,"props":1310,"children":1311},{},[1312],{"type":44,"value":1313},"Rotate certificates before expiry using IoT Jobs to push new certificates and a Lambda to register them. Expired certificates cause immediate connection failure with no grace period.",{"type":39,"tag":373,"props":1315,"children":1317},{"id":1316},"iot-policies",[1318],{"type":44,"value":1319},"IoT Policies",{"type":39,"tag":40,"props":1321,"children":1322},{},[1323],{"type":44,"value":1324},"IoT policies control what MQTT topics a device can publish\u002Fsubscribe to and what shadows\u002Fjobs it can access. Always use policy variables to scope per-device.",{"type":39,"tag":508,"props":1326,"children":1330},{"className":1327,"code":1328,"language":1329,"meta":516,"style":516},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"iot:Connect\",\n      \"Resource\": \"arn:aws:iot:REGION:ACCOUNT:client\u002F${iot:Connection.Thing.ThingName}\"\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"iot:Publish\",\n      \"Resource\": \"arn:aws:iot:REGION:ACCOUNT:topic\u002Facme\u002Fprod\u002F*\u002F${iot:Connection.Thing.ThingName}\u002F*\"\n    },\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"iot:Subscribe\",\n      \"Resource\": \"arn:aws:iot:REGION:ACCOUNT:topicfilter\u002Facme\u002Fprod\u002F*\u002F${iot:Connection.Thing.ThingName}\u002F*\"\n    }\n  ]\n}\n","json",[1331],{"type":39,"tag":69,"props":1332,"children":1333},{"__ignoreMap":516},[1334,1343,1387,1412,1421,1461,1499,1534,1543,1551,1587,1624,1657,1665,1672,1707,1744,1777,1786,1795],{"type":39,"tag":719,"props":1335,"children":1336},{"class":721,"line":722},[1337],{"type":39,"tag":719,"props":1338,"children":1340},{"style":1339},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1341],{"type":44,"value":1342},"{\n",{"type":39,"tag":719,"props":1344,"children":1345},{"class":721,"line":731},[1346,1351,1357,1362,1367,1372,1378,1382],{"type":39,"tag":719,"props":1347,"children":1348},{"style":1339},[1349],{"type":44,"value":1350},"  \"",{"type":39,"tag":719,"props":1352,"children":1354},{"style":1353},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[1355],{"type":44,"value":1356},"Version",{"type":39,"tag":719,"props":1358,"children":1359},{"style":1339},[1360],{"type":44,"value":1361},"\"",{"type":39,"tag":719,"props":1363,"children":1364},{"style":1339},[1365],{"type":44,"value":1366},":",{"type":39,"tag":719,"props":1368,"children":1369},{"style":1339},[1370],{"type":44,"value":1371}," \"",{"type":39,"tag":719,"props":1373,"children":1375},{"style":1374},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1376],{"type":44,"value":1377},"2012-10-17",{"type":39,"tag":719,"props":1379,"children":1380},{"style":1339},[1381],{"type":44,"value":1361},{"type":39,"tag":719,"props":1383,"children":1384},{"style":1339},[1385],{"type":44,"value":1386},",\n",{"type":39,"tag":719,"props":1388,"children":1389},{"class":721,"line":740},[1390,1394,1399,1403,1407],{"type":39,"tag":719,"props":1391,"children":1392},{"style":1339},[1393],{"type":44,"value":1350},{"type":39,"tag":719,"props":1395,"children":1396},{"style":1353},[1397],{"type":44,"value":1398},"Statement",{"type":39,"tag":719,"props":1400,"children":1401},{"style":1339},[1402],{"type":44,"value":1361},{"type":39,"tag":719,"props":1404,"children":1405},{"style":1339},[1406],{"type":44,"value":1366},{"type":39,"tag":719,"props":1408,"children":1409},{"style":1339},[1410],{"type":44,"value":1411}," [\n",{"type":39,"tag":719,"props":1413,"children":1415},{"class":721,"line":1414},4,[1416],{"type":39,"tag":719,"props":1417,"children":1418},{"style":1339},[1419],{"type":44,"value":1420},"    {\n",{"type":39,"tag":719,"props":1422,"children":1424},{"class":721,"line":1423},5,[1425,1430,1436,1440,1444,1448,1453,1457],{"type":39,"tag":719,"props":1426,"children":1427},{"style":1339},[1428],{"type":44,"value":1429},"      \"",{"type":39,"tag":719,"props":1431,"children":1433},{"style":1432},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1434],{"type":44,"value":1435},"Effect",{"type":39,"tag":719,"props":1437,"children":1438},{"style":1339},[1439],{"type":44,"value":1361},{"type":39,"tag":719,"props":1441,"children":1442},{"style":1339},[1443],{"type":44,"value":1366},{"type":39,"tag":719,"props":1445,"children":1446},{"style":1339},[1447],{"type":44,"value":1371},{"type":39,"tag":719,"props":1449,"children":1450},{"style":1374},[1451],{"type":44,"value":1452},"Allow",{"type":39,"tag":719,"props":1454,"children":1455},{"style":1339},[1456],{"type":44,"value":1361},{"type":39,"tag":719,"props":1458,"children":1459},{"style":1339},[1460],{"type":44,"value":1386},{"type":39,"tag":719,"props":1462,"children":1464},{"class":721,"line":1463},6,[1465,1469,1474,1478,1482,1486,1491,1495],{"type":39,"tag":719,"props":1466,"children":1467},{"style":1339},[1468],{"type":44,"value":1429},{"type":39,"tag":719,"props":1470,"children":1471},{"style":1432},[1472],{"type":44,"value":1473},"Action",{"type":39,"tag":719,"props":1475,"children":1476},{"style":1339},[1477],{"type":44,"value":1361},{"type":39,"tag":719,"props":1479,"children":1480},{"style":1339},[1481],{"type":44,"value":1366},{"type":39,"tag":719,"props":1483,"children":1484},{"style":1339},[1485],{"type":44,"value":1371},{"type":39,"tag":719,"props":1487,"children":1488},{"style":1374},[1489],{"type":44,"value":1490},"iot:Connect",{"type":39,"tag":719,"props":1492,"children":1493},{"style":1339},[1494],{"type":44,"value":1361},{"type":39,"tag":719,"props":1496,"children":1497},{"style":1339},[1498],{"type":44,"value":1386},{"type":39,"tag":719,"props":1500,"children":1502},{"class":721,"line":1501},7,[1503,1507,1512,1516,1520,1524,1529],{"type":39,"tag":719,"props":1504,"children":1505},{"style":1339},[1506],{"type":44,"value":1429},{"type":39,"tag":719,"props":1508,"children":1509},{"style":1432},[1510],{"type":44,"value":1511},"Resource",{"type":39,"tag":719,"props":1513,"children":1514},{"style":1339},[1515],{"type":44,"value":1361},{"type":39,"tag":719,"props":1517,"children":1518},{"style":1339},[1519],{"type":44,"value":1366},{"type":39,"tag":719,"props":1521,"children":1522},{"style":1339},[1523],{"type":44,"value":1371},{"type":39,"tag":719,"props":1525,"children":1526},{"style":1374},[1527],{"type":44,"value":1528},"arn:aws:iot:REGION:ACCOUNT:client\u002F${iot:Connection.Thing.ThingName}",{"type":39,"tag":719,"props":1530,"children":1531},{"style":1339},[1532],{"type":44,"value":1533},"\"\n",{"type":39,"tag":719,"props":1535,"children":1537},{"class":721,"line":1536},8,[1538],{"type":39,"tag":719,"props":1539,"children":1540},{"style":1339},[1541],{"type":44,"value":1542},"    },\n",{"type":39,"tag":719,"props":1544,"children":1546},{"class":721,"line":1545},9,[1547],{"type":39,"tag":719,"props":1548,"children":1549},{"style":1339},[1550],{"type":44,"value":1420},{"type":39,"tag":719,"props":1552,"children":1554},{"class":721,"line":1553},10,[1555,1559,1563,1567,1571,1575,1579,1583],{"type":39,"tag":719,"props":1556,"children":1557},{"style":1339},[1558],{"type":44,"value":1429},{"type":39,"tag":719,"props":1560,"children":1561},{"style":1432},[1562],{"type":44,"value":1435},{"type":39,"tag":719,"props":1564,"children":1565},{"style":1339},[1566],{"type":44,"value":1361},{"type":39,"tag":719,"props":1568,"children":1569},{"style":1339},[1570],{"type":44,"value":1366},{"type":39,"tag":719,"props":1572,"children":1573},{"style":1339},[1574],{"type":44,"value":1371},{"type":39,"tag":719,"props":1576,"children":1577},{"style":1374},[1578],{"type":44,"value":1452},{"type":39,"tag":719,"props":1580,"children":1581},{"style":1339},[1582],{"type":44,"value":1361},{"type":39,"tag":719,"props":1584,"children":1585},{"style":1339},[1586],{"type":44,"value":1386},{"type":39,"tag":719,"props":1588,"children":1590},{"class":721,"line":1589},11,[1591,1595,1599,1603,1607,1611,1616,1620],{"type":39,"tag":719,"props":1592,"children":1593},{"style":1339},[1594],{"type":44,"value":1429},{"type":39,"tag":719,"props":1596,"children":1597},{"style":1432},[1598],{"type":44,"value":1473},{"type":39,"tag":719,"props":1600,"children":1601},{"style":1339},[1602],{"type":44,"value":1361},{"type":39,"tag":719,"props":1604,"children":1605},{"style":1339},[1606],{"type":44,"value":1366},{"type":39,"tag":719,"props":1608,"children":1609},{"style":1339},[1610],{"type":44,"value":1371},{"type":39,"tag":719,"props":1612,"children":1613},{"style":1374},[1614],{"type":44,"value":1615},"iot:Publish",{"type":39,"tag":719,"props":1617,"children":1618},{"style":1339},[1619],{"type":44,"value":1361},{"type":39,"tag":719,"props":1621,"children":1622},{"style":1339},[1623],{"type":44,"value":1386},{"type":39,"tag":719,"props":1625,"children":1627},{"class":721,"line":1626},12,[1628,1632,1636,1640,1644,1648,1653],{"type":39,"tag":719,"props":1629,"children":1630},{"style":1339},[1631],{"type":44,"value":1429},{"type":39,"tag":719,"props":1633,"children":1634},{"style":1432},[1635],{"type":44,"value":1511},{"type":39,"tag":719,"props":1637,"children":1638},{"style":1339},[1639],{"type":44,"value":1361},{"type":39,"tag":719,"props":1641,"children":1642},{"style":1339},[1643],{"type":44,"value":1366},{"type":39,"tag":719,"props":1645,"children":1646},{"style":1339},[1647],{"type":44,"value":1371},{"type":39,"tag":719,"props":1649,"children":1650},{"style":1374},[1651],{"type":44,"value":1652},"arn:aws:iot:REGION:ACCOUNT:topic\u002Facme\u002Fprod\u002F*\u002F${iot:Connection.Thing.ThingName}\u002F*",{"type":39,"tag":719,"props":1654,"children":1655},{"style":1339},[1656],{"type":44,"value":1533},{"type":39,"tag":719,"props":1658,"children":1660},{"class":721,"line":1659},13,[1661],{"type":39,"tag":719,"props":1662,"children":1663},{"style":1339},[1664],{"type":44,"value":1542},{"type":39,"tag":719,"props":1666,"children":1667},{"class":721,"line":22},[1668],{"type":39,"tag":719,"props":1669,"children":1670},{"style":1339},[1671],{"type":44,"value":1420},{"type":39,"tag":719,"props":1673,"children":1674},{"class":721,"line":26},[1675,1679,1683,1687,1691,1695,1699,1703],{"type":39,"tag":719,"props":1676,"children":1677},{"style":1339},[1678],{"type":44,"value":1429},{"type":39,"tag":719,"props":1680,"children":1681},{"style":1432},[1682],{"type":44,"value":1435},{"type":39,"tag":719,"props":1684,"children":1685},{"style":1339},[1686],{"type":44,"value":1361},{"type":39,"tag":719,"props":1688,"children":1689},{"style":1339},[1690],{"type":44,"value":1366},{"type":39,"tag":719,"props":1692,"children":1693},{"style":1339},[1694],{"type":44,"value":1371},{"type":39,"tag":719,"props":1696,"children":1697},{"style":1374},[1698],{"type":44,"value":1452},{"type":39,"tag":719,"props":1700,"children":1701},{"style":1339},[1702],{"type":44,"value":1361},{"type":39,"tag":719,"props":1704,"children":1705},{"style":1339},[1706],{"type":44,"value":1386},{"type":39,"tag":719,"props":1708,"children":1710},{"class":721,"line":1709},16,[1711,1715,1719,1723,1727,1731,1736,1740],{"type":39,"tag":719,"props":1712,"children":1713},{"style":1339},[1714],{"type":44,"value":1429},{"type":39,"tag":719,"props":1716,"children":1717},{"style":1432},[1718],{"type":44,"value":1473},{"type":39,"tag":719,"props":1720,"children":1721},{"style":1339},[1722],{"type":44,"value":1361},{"type":39,"tag":719,"props":1724,"children":1725},{"style":1339},[1726],{"type":44,"value":1366},{"type":39,"tag":719,"props":1728,"children":1729},{"style":1339},[1730],{"type":44,"value":1371},{"type":39,"tag":719,"props":1732,"children":1733},{"style":1374},[1734],{"type":44,"value":1735},"iot:Subscribe",{"type":39,"tag":719,"props":1737,"children":1738},{"style":1339},[1739],{"type":44,"value":1361},{"type":39,"tag":719,"props":1741,"children":1742},{"style":1339},[1743],{"type":44,"value":1386},{"type":39,"tag":719,"props":1745,"children":1747},{"class":721,"line":1746},17,[1748,1752,1756,1760,1764,1768,1773],{"type":39,"tag":719,"props":1749,"children":1750},{"style":1339},[1751],{"type":44,"value":1429},{"type":39,"tag":719,"props":1753,"children":1754},{"style":1432},[1755],{"type":44,"value":1511},{"type":39,"tag":719,"props":1757,"children":1758},{"style":1339},[1759],{"type":44,"value":1361},{"type":39,"tag":719,"props":1761,"children":1762},{"style":1339},[1763],{"type":44,"value":1366},{"type":39,"tag":719,"props":1765,"children":1766},{"style":1339},[1767],{"type":44,"value":1371},{"type":39,"tag":719,"props":1769,"children":1770},{"style":1374},[1771],{"type":44,"value":1772},"arn:aws:iot:REGION:ACCOUNT:topicfilter\u002Facme\u002Fprod\u002F*\u002F${iot:Connection.Thing.ThingName}\u002F*",{"type":39,"tag":719,"props":1774,"children":1775},{"style":1339},[1776],{"type":44,"value":1533},{"type":39,"tag":719,"props":1778,"children":1780},{"class":721,"line":1779},18,[1781],{"type":39,"tag":719,"props":1782,"children":1783},{"style":1339},[1784],{"type":44,"value":1785},"    }\n",{"type":39,"tag":719,"props":1787,"children":1789},{"class":721,"line":1788},19,[1790],{"type":39,"tag":719,"props":1791,"children":1792},{"style":1339},[1793],{"type":44,"value":1794},"  ]\n",{"type":39,"tag":719,"props":1796,"children":1798},{"class":721,"line":1797},20,[1799],{"type":39,"tag":719,"props":1800,"children":1801},{"style":1339},[1802],{"type":44,"value":1803},"}\n",{"type":39,"tag":373,"props":1805,"children":1807},{"id":1806},"custom-authorizers",[1808],{"type":44,"value":1809},"Custom Authorizers",{"type":39,"tag":40,"props":1811,"children":1812},{},[1813],{"type":44,"value":1814},"Use custom authorizers when devices cannot use X.509 certificates (e.g., legacy devices with token-based auth or OAuth). The authorizer is a Lambda function that validates the token and returns an IoT policy document. Custom authorizers add latency (Lambda cold start) and cost (per-invocation), so prefer X.509 certificates for new device designs.",{"type":39,"tag":373,"props":1816,"children":1818},{"id":1817},"device-defender",[1819],{"type":44,"value":1820},"Device Defender",{"type":39,"tag":385,"props":1822,"children":1823},{},[1824,1834,1844],{"type":39,"tag":58,"props":1825,"children":1826},{},[1827,1832],{"type":39,"tag":392,"props":1828,"children":1829},{},[1830],{"type":44,"value":1831},"Audit",{"type":44,"value":1833},": Scheduled checks for insecure configurations (overly permissive policies, shared certificates, disabled logging). Run at least weekly.",{"type":39,"tag":58,"props":1835,"children":1836},{},[1837,1842],{"type":39,"tag":392,"props":1838,"children":1839},{},[1840],{"type":44,"value":1841},"Detect",{"type":44,"value":1843},": Real-time anomaly detection on device metrics (message volume, connection patterns, authorization failures). Alerts when a device deviates from its baseline behavior, indicating compromise or misconfiguration.",{"type":39,"tag":58,"props":1845,"children":1846},{},[1847],{"type":44,"value":1848},"Configure mitigation actions to automatically quarantine compromised devices (move to a restricted thing group with minimal permissions).",{"type":39,"tag":47,"props":1850,"children":1852},{"id":1851},"data-storage-patterns",[1853],{"type":44,"value":1854},"Data Storage Patterns",{"type":39,"tag":373,"props":1856,"children":1858},{"id":1857},"timestream-time-series-telemetry",[1859],{"type":44,"value":1860},"Timestream (Time-Series Telemetry)",{"type":39,"tag":385,"props":1862,"children":1863},{},[1864,1869,1874,1879],{"type":39,"tag":58,"props":1865,"children":1866},{},[1867],{"type":44,"value":1868},"Default choice for telemetry that needs time-range queries (temperature over last 24 hours, average power per hour).",{"type":39,"tag":58,"props":1870,"children":1871},{},[1872],{"type":44,"value":1873},"Automatic tiering: memory store (recent, fast queries) to magnetic store (historical, cheaper).",{"type":39,"tag":58,"props":1875,"children":1876},{},[1877],{"type":44,"value":1878},"Set memory store retention to match your hot-query window (1-24 hours typical). Data beyond this moves to magnetic automatically.",{"type":39,"tag":58,"props":1880,"children":1881},{},[1882],{"type":44,"value":1883},"Cost consideration: Timestream charges per write and per query scan. For very high-frequency telemetry (>1 msg\u002Fsec\u002Fdevice across thousands of devices), aggregate at the edge with Greengrass or use Basic Ingest to S3 with Athena for batch queries.",{"type":39,"tag":373,"props":1885,"children":1887},{"id":1886},"dynamodb-device-metadata-and-state",[1888],{"type":44,"value":1889},"DynamoDB (Device Metadata and State)",{"type":39,"tag":385,"props":1891,"children":1892},{},[1893,1898,1903,1908],{"type":39,"tag":58,"props":1894,"children":1895},{},[1896],{"type":44,"value":1897},"Use for device registry extensions, latest-known state, configuration, and command history.",{"type":39,"tag":58,"props":1899,"children":1900},{},[1901],{"type":44,"value":1902},"Design the partition key as the device ID for even distribution.",{"type":39,"tag":58,"props":1904,"children":1905},{},[1906],{"type":44,"value":1907},"Use TTL to auto-expire old command records and reduce storage cost.",{"type":39,"tag":58,"props":1909,"children":1910},{},[1911],{"type":44,"value":1912},"Do not store raw time-series telemetry in DynamoDB. At 1 msg\u002Fsec from 10,000 devices, that is 864 million writes\u002Fday, which costs roughly $1,100\u002Fday in on-demand WCU charges.",{"type":39,"tag":373,"props":1914,"children":1916},{"id":1915},"s3-bulk-archival",[1917],{"type":44,"value":1918},"S3 (Bulk Archival)",{"type":39,"tag":385,"props":1920,"children":1921},{},[1922,1933,1938,1943],{"type":39,"tag":58,"props":1923,"children":1924},{},[1925,1927],{"type":44,"value":1926},"Use IoT Rules Engine S3 action with partitioned keys: ",{"type":39,"tag":69,"props":1928,"children":1930},{"className":1929},[],[1931],{"type":44,"value":1932},"s3:\u002F\u002Fbucket\u002Fyear=2026\u002Fmonth=04\u002Fday=06\u002Fhour=12\u002Fdevice-id.json",{"type":39,"tag":58,"props":1934,"children":1935},{},[1936],{"type":44,"value":1937},"Query archived data with Athena using partition projection for cost-effective ad-hoc analysis.",{"type":39,"tag":58,"props":1939,"children":1940},{},[1941],{"type":44,"value":1942},"Enable S3 Intelligent-Tiering for automatic cost optimization on infrequently accessed telemetry.",{"type":39,"tag":58,"props":1944,"children":1945},{},[1946],{"type":44,"value":1947},"Cheapest option for long-term retention and compliance requirements.",{"type":39,"tag":373,"props":1949,"children":1951},{"id":1950},"opensearch-search-and-analytics",[1952],{"type":44,"value":1953},"OpenSearch (Search and Analytics)",{"type":39,"tag":385,"props":1955,"children":1956},{},[1957,1962,1967],{"type":39,"tag":58,"props":1958,"children":1959},{},[1960],{"type":44,"value":1961},"Use when operators need full-text search across telemetry fields or real-time dashboards.",{"type":39,"tag":58,"props":1963,"children":1964},{},[1965],{"type":44,"value":1966},"IoT Rules Engine can write directly to OpenSearch Service.",{"type":39,"tag":58,"props":1968,"children":1969},{},[1970],{"type":44,"value":1971},"Cost consideration: OpenSearch clusters run 24\u002F7 with dedicated instances. For intermittent analysis, prefer Athena on S3.",{"type":39,"tag":47,"props":1973,"children":1975},{"id":1974},"greengrass-v2-edge-compute",[1976],{"type":44,"value":1977},"Greengrass v2 (Edge Compute)",{"type":39,"tag":373,"props":1979,"children":1981},{"id":1980},"when-to-use-edge-compute",[1982],{"type":44,"value":1983},"When to Use Edge Compute",{"type":39,"tag":385,"props":1985,"children":1986},{},[1987,1997,2007,2017],{"type":39,"tag":58,"props":1988,"children":1989},{},[1990,1995],{"type":39,"tag":392,"props":1991,"children":1992},{},[1993],{"type":44,"value":1994},"Latency",{"type":44,"value":1996},": Local control loops that must respond in \u003C100ms (actuator control, safety shutoffs). Cloud round-trip adds 50-200ms minimum.",{"type":39,"tag":58,"props":1998,"children":1999},{},[2000,2005],{"type":39,"tag":392,"props":2001,"children":2002},{},[2003],{"type":44,"value":2004},"Bandwidth",{"type":44,"value":2006},": Devices generate more data than the network can upload. Aggregate or filter at the edge, send summaries to cloud.",{"type":39,"tag":58,"props":2008,"children":2009},{},[2010,2015],{"type":39,"tag":392,"props":2011,"children":2012},{},[2013],{"type":44,"value":2014},"Intermittent connectivity",{"type":44,"value":2016},": Sites with unreliable internet (remote oil wells, ships, mines). Greengrass buffers data and syncs when connected.",{"type":39,"tag":58,"props":2018,"children":2019},{},[2020,2025],{"type":39,"tag":392,"props":2021,"children":2022},{},[2023],{"type":44,"value":2024},"Local ML inference",{"type":44,"value":2026},": Run ML models on edge hardware (image classification, anomaly detection) without sending raw data to cloud.",{"type":39,"tag":373,"props":2028,"children":2030},{"id":2029},"when-to-skip-edge-compute",[2031],{"type":44,"value":2032},"When to Skip Edge Compute",{"type":39,"tag":385,"props":2034,"children":2035},{},[2036,2041],{"type":39,"tag":58,"props":2037,"children":2038},{},[2039],{"type":44,"value":2040},"Devices with reliable, high-bandwidth connectivity and no latency requirements. Direct MQTT to IoT Core is simpler and eliminates edge infrastructure management.",{"type":39,"tag":58,"props":2042,"children":2043},{},[2044],{"type":44,"value":2045},"Very constrained devices (microcontrollers with \u003C1MB RAM) that cannot run the Greengrass nucleus. Use FreeRTOS with direct IoT Core connectivity instead.",{"type":39,"tag":373,"props":2047,"children":2049},{"id":2048},"component-model",[2050],{"type":44,"value":2051},"Component Model",{"type":39,"tag":40,"props":2053,"children":2054},{},[2055],{"type":44,"value":2056},"Greengrass v2 uses a component model where each capability is a deployable unit (recipe + artifacts). Components can be:",{"type":39,"tag":385,"props":2058,"children":2059},{},[2060,2070,2080],{"type":39,"tag":58,"props":2061,"children":2062},{},[2063,2068],{"type":39,"tag":392,"props":2064,"children":2065},{},[2066],{"type":44,"value":2067},"AWS-provided",{"type":44,"value":2069},": Pre-built components for common tasks (stream manager, log manager, MQTT bridge, Docker application manager)",{"type":39,"tag":58,"props":2071,"children":2072},{},[2073,2078],{"type":39,"tag":392,"props":2074,"children":2075},{},[2076],{"type":44,"value":2077},"Custom",{"type":44,"value":2079},": Your application logic, packaged as a recipe (YAML\u002FJSON) referencing artifacts (code, binaries, configs)",{"type":39,"tag":58,"props":2081,"children":2082},{},[2083,2088],{"type":39,"tag":392,"props":2084,"children":2085},{},[2086],{"type":44,"value":2087},"Community",{"type":44,"value":2089},": Third-party components from the Greengrass component catalog",{"type":39,"tag":373,"props":2091,"children":2093},{"id":2092},"stream-manager",[2094],{"type":44,"value":2095},"Stream Manager",{"type":39,"tag":40,"props":2097,"children":2098},{},[2099],{"type":44,"value":2100},"Use Stream Manager for reliable edge-to-cloud data transfer. It handles buffering, batching, bandwidth management, and automatic retry. Supports export to Kinesis Data Streams, S3, IoT Analytics, and IoT SiteWise.",{"type":39,"tag":385,"props":2102,"children":2103},{},[2104,2109,2114],{"type":39,"tag":58,"props":2105,"children":2106},{},[2107],{"type":44,"value":2108},"Configure per-stream: storage type (memory or file-system), max size, strategy when full (reject new or overwrite oldest)",{"type":39,"tag":58,"props":2110,"children":2111},{},[2112],{"type":44,"value":2113},"Set bandwidth limits to prevent telemetry uploads from starving control-plane traffic",{"type":39,"tag":58,"props":2115,"children":2116},{},[2117],{"type":44,"value":2118},"Minimum 70 MB RAM overhead for the stream manager component",{"type":39,"tag":40,"props":2120,"children":2121},{},[2122,2123,2129],{"type":44,"value":1019},{"type":39,"tag":69,"props":2124,"children":2126},{"className":2125},[],[2127],{"type":44,"value":2128},"references\u002Fgreengrass-patterns.md",{"type":44,"value":2130}," for component recipes, deployment configurations, and stream manager setup.",{"type":39,"tag":47,"props":2132,"children":2134},{"id":2133},"fleet-management",[2135],{"type":44,"value":2136},"Fleet Management",{"type":39,"tag":373,"props":2138,"children":2140},{"id":2139},"iot-jobs-ota-updates",[2141],{"type":44,"value":2142},"IoT Jobs (OTA Updates)",{"type":39,"tag":385,"props":2144,"children":2145},{},[2146,2151,2161,2171,2176],{"type":39,"tag":58,"props":2147,"children":2148},{},[2149],{"type":44,"value":2150},"Use Jobs for firmware updates, configuration changes, and certificate rotation across the fleet.",{"type":39,"tag":58,"props":2152,"children":2153},{},[2154,2159],{"type":39,"tag":392,"props":2155,"children":2156},{},[2157],{"type":44,"value":2158},"Continuous jobs",{"type":44,"value":2160},": Automatically target new devices added to a thing group. Use for ongoing compliance (all devices in group X must have firmware v2.3+).",{"type":39,"tag":58,"props":2162,"children":2163},{},[2164,2169],{"type":39,"tag":392,"props":2165,"children":2166},{},[2167],{"type":44,"value":2168},"Snapshot jobs",{"type":44,"value":2170},": One-time execution against a fixed set of targets.",{"type":39,"tag":58,"props":2172,"children":2173},{},[2174],{"type":44,"value":2175},"Configure rollout rate (max devices per minute) and abort criteria (% failures before halting) to prevent fleet-wide bricking from a bad update.",{"type":39,"tag":58,"props":2177,"children":2178},{},[2179],{"type":44,"value":2180},"Use signed job documents with code signing to prevent tampering.",{"type":39,"tag":373,"props":2182,"children":2184},{"id":2183},"fleet-indexing",[2185],{"type":44,"value":2186},"Fleet Indexing",{"type":39,"tag":385,"props":2188,"children":2189},{},[2190,2195,2200,2213],{"type":39,"tag":58,"props":2191,"children":2192},{},[2193],{"type":44,"value":2194},"Enables SQL-like queries across device registry, shadow, connectivity, and Device Defender violation data.",{"type":39,"tag":58,"props":2196,"children":2197},{},[2198],{"type":44,"value":2199},"Must be explicitly enabled (off by default). Without fleet indexing, you cannot query fleet state at scale.",{"type":39,"tag":58,"props":2201,"children":2202},{},[2203,2205,2211],{"type":44,"value":2204},"Example: ",{"type":39,"tag":69,"props":2206,"children":2208},{"className":2207},[],[2209],{"type":44,"value":2210},"thingName:sensor-* AND shadow.reported.firmware:v2.1 AND connectivity.connected:false",{"type":44,"value":2212}," finds all disconnected sensors on old firmware.",{"type":39,"tag":58,"props":2214,"children":2215},{},[2216],{"type":44,"value":2217},"Use fleet metrics to push aggregated fleet statistics to CloudWatch for dashboards and alarms.",{"type":39,"tag":373,"props":2219,"children":2221},{"id":2220},"key-limits-iot-core",[2222],{"type":44,"value":2223},"Key Limits (IoT Core)",{"type":39,"tag":137,"props":2225,"children":2226},{},[2227,2247],{"type":39,"tag":141,"props":2228,"children":2229},{},[2230],{"type":39,"tag":145,"props":2231,"children":2232},{},[2233,2237,2242],{"type":39,"tag":149,"props":2234,"children":2235},{},[2236],{"type":44,"value":1511},{"type":39,"tag":149,"props":2238,"children":2239},{},[2240],{"type":44,"value":2241},"Default Limit",{"type":39,"tag":149,"props":2243,"children":2244},{},[2245],{"type":44,"value":2246},"Notes",{"type":39,"tag":165,"props":2248,"children":2249},{},[2250,2268,2286,2303,2321,2339,2356,2373,2390,2406,2423],{"type":39,"tag":145,"props":2251,"children":2252},{},[2253,2258,2263],{"type":39,"tag":172,"props":2254,"children":2255},{},[2256],{"type":44,"value":2257},"Maximum concurrent connections",{"type":39,"tag":172,"props":2259,"children":2260},{},[2261],{"type":44,"value":2262},"500,000 per account",{"type":39,"tag":172,"props":2264,"children":2265},{},[2266],{"type":44,"value":2267},"Requestable increase",{"type":39,"tag":145,"props":2269,"children":2270},{},[2271,2276,2281],{"type":39,"tag":172,"props":2272,"children":2273},{},[2274],{"type":44,"value":2275},"Maximum MQTT message size",{"type":39,"tag":172,"props":2277,"children":2278},{},[2279],{"type":44,"value":2280},"128 KB",{"type":39,"tag":172,"props":2282,"children":2283},{},[2284],{"type":44,"value":2285},"Hard limit",{"type":39,"tag":145,"props":2287,"children":2288},{},[2289,2294,2299],{"type":39,"tag":172,"props":2290,"children":2291},{},[2292],{"type":44,"value":2293},"Maximum publishes per second (per account)",{"type":39,"tag":172,"props":2295,"children":2296},{},[2297],{"type":44,"value":2298},"20,000",{"type":39,"tag":172,"props":2300,"children":2301},{},[2302],{"type":44,"value":2267},{"type":39,"tag":145,"props":2304,"children":2305},{},[2306,2311,2316],{"type":39,"tag":172,"props":2307,"children":2308},{},[2309],{"type":44,"value":2310},"Maximum inbound publishes per second (per connection)",{"type":39,"tag":172,"props":2312,"children":2313},{},[2314],{"type":44,"value":2315},"100",{"type":39,"tag":172,"props":2317,"children":2318},{},[2319],{"type":44,"value":2320},"Per-device throttle",{"type":39,"tag":145,"props":2322,"children":2323},{},[2324,2329,2334],{"type":39,"tag":172,"props":2325,"children":2326},{},[2327],{"type":44,"value":2328},"Persistent session expiry",{"type":39,"tag":172,"props":2330,"children":2331},{},[2332],{"type":44,"value":2333},"1 hour (default), up to 7 days",{"type":39,"tag":172,"props":2335,"children":2336},{},[2337],{"type":44,"value":2338},"Configure per client",{"type":39,"tag":145,"props":2340,"children":2341},{},[2342,2347,2352],{"type":39,"tag":172,"props":2343,"children":2344},{},[2345],{"type":44,"value":2346},"Maximum rules per account",{"type":39,"tag":172,"props":2348,"children":2349},{},[2350],{"type":44,"value":2351},"1,000",{"type":39,"tag":172,"props":2353,"children":2354},{},[2355],{"type":44,"value":2267},{"type":39,"tag":145,"props":2357,"children":2358},{},[2359,2364,2369],{"type":39,"tag":172,"props":2360,"children":2361},{},[2362],{"type":44,"value":2363},"Maximum actions per rule",{"type":39,"tag":172,"props":2365,"children":2366},{},[2367],{"type":44,"value":2368},"10",{"type":39,"tag":172,"props":2370,"children":2371},{},[2372],{"type":44,"value":2285},{"type":39,"tag":145,"props":2374,"children":2375},{},[2376,2381,2386],{"type":39,"tag":172,"props":2377,"children":2378},{},[2379],{"type":44,"value":2380},"Maximum shadow document size",{"type":39,"tag":172,"props":2382,"children":2383},{},[2384],{"type":44,"value":2385},"8 KB (classic), 8 KB (named)",{"type":39,"tag":172,"props":2387,"children":2388},{},[2389],{"type":44,"value":2285},{"type":39,"tag":145,"props":2391,"children":2392},{},[2393,2398,2402],{"type":39,"tag":172,"props":2394,"children":2395},{},[2396],{"type":44,"value":2397},"Named shadows per thing",{"type":39,"tag":172,"props":2399,"children":2400},{},[2401],{"type":44,"value":2368},{"type":39,"tag":172,"props":2403,"children":2404},{},[2405],{"type":44,"value":2285},{"type":39,"tag":145,"props":2407,"children":2408},{},[2409,2414,2419],{"type":39,"tag":172,"props":2410,"children":2411},{},[2412],{"type":44,"value":2413},"Fleet provisioning templates per account",{"type":39,"tag":172,"props":2415,"children":2416},{},[2417],{"type":44,"value":2418},"256",{"type":39,"tag":172,"props":2420,"children":2421},{},[2422],{"type":44,"value":2267},{"type":39,"tag":145,"props":2424,"children":2425},{},[2426,2431,2436],{"type":39,"tag":172,"props":2427,"children":2428},{},[2429],{"type":44,"value":2430},"Thing groups depth",{"type":39,"tag":172,"props":2432,"children":2433},{},[2434],{"type":44,"value":2435},"7 levels",{"type":39,"tag":172,"props":2437,"children":2438},{},[2439],{"type":44,"value":2285},{"type":39,"tag":47,"props":2441,"children":2443},{"id":2442},"anti-patterns",[2444],{"type":44,"value":2445},"Anti-Patterns",{"type":39,"tag":385,"props":2447,"children":2448},{},[2449,2459,2469,2505,2523,2533,2543,2553,2563,2573,2583,2593],{"type":39,"tag":58,"props":2450,"children":2451},{},[2452,2457],{"type":39,"tag":392,"props":2453,"children":2454},{},[2455],{"type":44,"value":2456},"Polling instead of MQTT.",{"type":44,"value":2458}," Devices that HTTP poll for commands waste battery, bandwidth, and IoT Core request costs. A device polling every 5 seconds generates 17,280 requests\u002Fday; MQTT keeps a persistent connection with near-zero overhead when idle, and the server pushes commands instantly.",{"type":39,"tag":58,"props":2460,"children":2461},{},[2462,2467],{"type":39,"tag":392,"props":2463,"children":2464},{},[2465],{"type":44,"value":2466},"No error actions on rules.",{"type":44,"value":2468}," Without an error action, a failed rule action (IAM permission issue, DynamoDB throttle, Lambda error) silently drops the message. There is no retry, no alert, and no way to recover the data. Always route errors to S3 or SQS.",{"type":39,"tag":58,"props":2470,"children":2471},{},[2472,2488,2490,2496,2498,2503],{"type":39,"tag":2473,"props":2474,"children":2475},"em",{},[2476,2481,2483],{"type":39,"tag":2473,"props":2477,"children":2478},{},[2479],{"type":44,"value":2480},"Overly permissive IoT policies (iot:",{"type":44,"value":2482}," on ",{"type":39,"tag":2473,"props":2484,"children":2485},{},[2486],{"type":44,"value":2487},").",{"type":44,"value":2489}," A compromised device with ",{"type":39,"tag":69,"props":2491,"children":2493},{"className":2492},[],[2494],{"type":44,"value":2495},"iot:*",{"type":44,"value":2497}," can publish to any topic, read any shadow, and trigger any job. Use policy variables (",{"type":39,"tag":69,"props":2499,"children":2501},{"className":2500},[],[2502],{"type":44,"value":552},{"type":44,"value":2504},") to scope each device to its own resources.",{"type":39,"tag":58,"props":2506,"children":2507},{},[2508,2513,2515,2521],{"type":39,"tag":392,"props":2509,"children":2510},{},[2511],{"type":44,"value":2512},"Single MQTT topic for all devices.",{"type":44,"value":2514}," Publishing everything to ",{"type":39,"tag":69,"props":2516,"children":2518},{"className":2517},[],[2519],{"type":44,"value":2520},"devices\u002Ftelemetry",{"type":44,"value":2522}," makes it impossible to apply per-device access control, filter rules by device type, or subscribe to a specific device's data. Use hierarchical topics with device identity segments.",{"type":39,"tag":58,"props":2524,"children":2525},{},[2526,2531],{"type":39,"tag":392,"props":2527,"children":2528},{},[2529],{"type":44,"value":2530},"Not using Device Shadow for desired\u002Freported state sync.",{"type":44,"value":2532}," Without shadows, setting device state requires the device to be online at the exact moment the command is sent. Shadows persist the desired state and deliver it when the device reconnects.",{"type":39,"tag":58,"props":2534,"children":2535},{},[2536,2541],{"type":39,"tag":392,"props":2537,"children":2538},{},[2539],{"type":44,"value":2540},"Storing raw telemetry in DynamoDB.",{"type":44,"value":2542}," At IoT scale, DynamoDB write costs explode. 10,000 devices at 1 msg\u002Fsec = 864M writes\u002Fday = ~$1,100\u002Fday on-demand. Use Timestream for time-series (10-20x cheaper for write-heavy time-series workloads) or S3 for archival ($0.023\u002FGB\u002Fmonth).",{"type":39,"tag":58,"props":2544,"children":2545},{},[2546,2551],{"type":39,"tag":392,"props":2547,"children":2548},{},[2549],{"type":44,"value":2550},"Ignoring Greengrass for edge preprocessing.",{"type":44,"value":2552}," Sending raw high-frequency sensor data to the cloud wastes bandwidth and inflates ingestion costs. A Greengrass component that averages 1,000 readings into 1 summary per minute reduces cloud costs by 99.9%.",{"type":39,"tag":58,"props":2554,"children":2555},{},[2556,2561],{"type":39,"tag":392,"props":2557,"children":2558},{},[2559],{"type":44,"value":2560},"Not configuring fleet indexing.",{"type":44,"value":2562}," Without fleet indexing enabled, you cannot query which devices are running old firmware, which are disconnected, or which have specific shadow states. You are flying blind on fleet health. Enable it proactively.",{"type":39,"tag":58,"props":2564,"children":2565},{},[2566,2571],{"type":39,"tag":392,"props":2567,"children":2568},{},[2569],{"type":44,"value":2570},"Shared X.509 certificates across devices.",{"type":44,"value":2572}," If one device is compromised, you must revoke the shared certificate, disconnecting all devices that use it. One certificate per device limits the blast radius to a single device.",{"type":39,"tag":58,"props":2574,"children":2575},{},[2576,2581],{"type":39,"tag":392,"props":2577,"children":2578},{},[2579],{"type":44,"value":2580},"No rollout controls on IoT Jobs.",{"type":44,"value":2582}," Pushing a firmware update to all devices simultaneously risks fleet-wide failure. Always configure max concurrent targets, rollout rate, and abort thresholds (e.g., abort if >5% of devices fail).",{"type":39,"tag":58,"props":2584,"children":2585},{},[2586,2591],{"type":39,"tag":392,"props":2587,"children":2588},{},[2589],{"type":44,"value":2590},"Ignoring Basic Ingest for high-volume telemetry.",{"type":44,"value":2592}," Standard publish costs $1.00 per million messages. Basic Ingest ($0.00 publish cost, rules actions still charged) saves this entirely for telemetry that only needs to flow to rules engine actions.",{"type":39,"tag":58,"props":2594,"children":2595},{},[2596,2601],{"type":39,"tag":392,"props":2597,"children":2598},{},[2599],{"type":44,"value":2600},"Not setting MQTT session expiry.",{"type":44,"value":2602}," Default persistent session expiry is 1 hour. Devices that reconnect after longer disconnections lose queued messages. Set session expiry to match the device's expected offline duration (up to 7 days max).",{"type":39,"tag":47,"props":2604,"children":2606},{"id":2605},"additional-resources",[2607],{"type":44,"value":2608},"Additional Resources",{"type":39,"tag":373,"props":2610,"children":2612},{"id":2611},"reference-files",[2613],{"type":44,"value":2614},"Reference Files",{"type":39,"tag":40,"props":2616,"children":2617},{},[2618],{"type":44,"value":2619},"For detailed operational guidance, consult:",{"type":39,"tag":385,"props":2621,"children":2622},{},[2623,2636,2649],{"type":39,"tag":58,"props":2624,"children":2625},{},[2626,2634],{"type":39,"tag":392,"props":2627,"children":2628},{},[2629],{"type":39,"tag":69,"props":2630,"children":2632},{"className":2631},[],[2633],{"type":44,"value":1025},{"type":44,"value":2635}," -- Rule SQL examples for common routing patterns, error action configuration, topic structure best practices, and Basic Ingest setup",{"type":39,"tag":58,"props":2637,"children":2638},{},[2639,2647],{"type":39,"tag":392,"props":2640,"children":2641},{},[2642],{"type":39,"tag":69,"props":2643,"children":2645},{"className":2644},[],[2646],{"type":44,"value":1281},{"type":44,"value":2648}," -- X.509 certificate management, fleet provisioning templates (JITP, bulk, by claim), IoT policies with variables, and custom authorizer setup",{"type":39,"tag":58,"props":2650,"children":2651},{},[2652,2660],{"type":39,"tag":392,"props":2653,"children":2654},{},[2655],{"type":39,"tag":69,"props":2656,"children":2658},{"className":2657},[],[2659],{"type":44,"value":2128},{"type":44,"value":2661}," -- Greengrass v2 component recipes, deployment configurations, stream manager setup, and local MQTT bridge configuration",{"type":39,"tag":373,"props":2663,"children":2665},{"id":2664},"related-skills",[2666],{"type":44,"value":2667},"Related Skills",{"type":39,"tag":385,"props":2669,"children":2670},{},[2671,2685,2699,2713,2727,2741,2755,2769,2783],{"type":39,"tag":58,"props":2672,"children":2673},{},[2674,2683],{"type":39,"tag":392,"props":2675,"children":2676},{},[2677],{"type":39,"tag":69,"props":2678,"children":2680},{"className":2679},[],[2681],{"type":44,"value":2682},"lambda",{"type":44,"value":2684}," -- Lambda functions as IoT rule actions and Greengrass components",{"type":39,"tag":58,"props":2686,"children":2687},{},[2688,2697],{"type":39,"tag":392,"props":2689,"children":2690},{},[2691],{"type":39,"tag":69,"props":2692,"children":2694},{"className":2693},[],[2695],{"type":44,"value":2696},"step-functions",{"type":44,"value":2698}," -- Orchestrating multi-step device provisioning and remediation workflows",{"type":39,"tag":58,"props":2700,"children":2701},{},[2702,2711],{"type":39,"tag":392,"props":2703,"children":2704},{},[2705],{"type":39,"tag":69,"props":2706,"children":2708},{"className":2707},[],[2709],{"type":44,"value":2710},"dynamodb",{"type":44,"value":2712}," -- Device metadata storage design, partition key strategy, TTL configuration",{"type":39,"tag":58,"props":2714,"children":2715},{},[2716,2725],{"type":39,"tag":392,"props":2717,"children":2718},{},[2719],{"type":39,"tag":69,"props":2720,"children":2722},{"className":2721},[],[2723],{"type":44,"value":2724},"s3",{"type":44,"value":2726}," -- Telemetry archival, lifecycle policies, Athena integration for batch queries",{"type":39,"tag":58,"props":2728,"children":2729},{},[2730,2739],{"type":39,"tag":392,"props":2731,"children":2732},{},[2733],{"type":39,"tag":69,"props":2734,"children":2736},{"className":2735},[],[2737],{"type":44,"value":2738},"messaging",{"type":44,"value":2740}," -- SQS\u002FSNS integration with IoT rules for decoupled processing and alerting",{"type":39,"tag":58,"props":2742,"children":2743},{},[2744,2753],{"type":39,"tag":392,"props":2745,"children":2746},{},[2747],{"type":39,"tag":69,"props":2748,"children":2750},{"className":2749},[],[2751],{"type":44,"value":2752},"observability",{"type":44,"value":2754}," -- CloudWatch metrics, alarms, and dashboards for IoT fleet monitoring",{"type":39,"tag":58,"props":2756,"children":2757},{},[2758,2767],{"type":39,"tag":392,"props":2759,"children":2760},{},[2761],{"type":39,"tag":69,"props":2762,"children":2764},{"className":2763},[],[2765],{"type":44,"value":2766},"iam",{"type":44,"value":2768}," -- IAM roles for IoT rules engine actions, Greengrass token exchange, and fleet provisioning",{"type":39,"tag":58,"props":2770,"children":2771},{},[2772,2781],{"type":39,"tag":392,"props":2773,"children":2774},{},[2775],{"type":39,"tag":69,"props":2776,"children":2778},{"className":2777},[],[2779],{"type":44,"value":2780},"networking",{"type":44,"value":2782}," -- VPC endpoints for IoT Core, private connectivity for Greengrass core devices",{"type":39,"tag":58,"props":2784,"children":2785},{},[2786,2795],{"type":39,"tag":392,"props":2787,"children":2788},{},[2789],{"type":39,"tag":69,"props":2790,"children":2792},{"className":2791},[],[2793],{"type":44,"value":2794},"security-review",{"type":44,"value":2796}," -- Security audit of IoT policies, certificate management, and Device Defender configuration",{"type":39,"tag":47,"props":2798,"children":2800},{"id":2799},"output-format",[2801],{"type":44,"value":2802},"Output Format",{"type":39,"tag":40,"props":2804,"children":2805},{},[2806],{"type":44,"value":2807},"When recommending an IoT architecture, include:",{"type":39,"tag":137,"props":2809,"children":2810},{},[2811,2832],{"type":39,"tag":141,"props":2812,"children":2813},{},[2814],{"type":39,"tag":145,"props":2815,"children":2816},{},[2817,2822,2827],{"type":39,"tag":149,"props":2818,"children":2819},{},[2820],{"type":44,"value":2821},"Component",{"type":39,"tag":149,"props":2823,"children":2824},{},[2825],{"type":44,"value":2826},"Choice",{"type":39,"tag":149,"props":2828,"children":2829},{},[2830],{"type":44,"value":2831},"Rationale",{"type":39,"tag":165,"props":2833,"children":2834},{},[2835,2853,2871,2889,2911,2929,2947,2965,2982],{"type":39,"tag":145,"props":2836,"children":2837},{},[2838,2843,2848],{"type":39,"tag":172,"props":2839,"children":2840},{},[2841],{"type":44,"value":2842},"Protocol",{"type":39,"tag":172,"props":2844,"children":2845},{},[2846],{"type":44,"value":2847},"MQTT v5 over TLS 8883",{"type":39,"tag":172,"props":2849,"children":2850},{},[2851],{"type":44,"value":2852},"Bidirectional, persistent, low overhead",{"type":39,"tag":145,"props":2854,"children":2855},{},[2856,2861,2866],{"type":39,"tag":172,"props":2857,"children":2858},{},[2859],{"type":44,"value":2860},"Authentication",{"type":39,"tag":172,"props":2862,"children":2863},{},[2864],{"type":44,"value":2865},"X.509 per-device certificates via AWS Private CA",{"type":39,"tag":172,"props":2867,"children":2868},{},[2869],{"type":44,"value":2870},"Hardware-bound identity, scalable revocation",{"type":39,"tag":145,"props":2872,"children":2873},{},[2874,2879,2884],{"type":39,"tag":172,"props":2875,"children":2876},{},[2877],{"type":44,"value":2878},"Provisioning",{"type":39,"tag":172,"props":2880,"children":2881},{},[2882],{"type":44,"value":2883},"Fleet Provisioning by Claim with pre-provisioning hook",{"type":39,"tag":172,"props":2885,"children":2886},{},[2887],{"type":44,"value":2888},"Devices cannot be provisioned in factory",{"type":39,"tag":145,"props":2890,"children":2891},{},[2892,2897,2906],{"type":39,"tag":172,"props":2893,"children":2894},{},[2895],{"type":44,"value":2896},"Topic Structure",{"type":39,"tag":172,"props":2898,"children":2899},{},[2900],{"type":39,"tag":69,"props":2901,"children":2903},{"className":2902},[],[2904],{"type":44,"value":2905},"{org}\u002Fprod\u002F{type}\u002F{device-id}\u002F{category}",{"type":39,"tag":172,"props":2907,"children":2908},{},[2909],{"type":44,"value":2910},"Per-device access control, rule targeting",{"type":39,"tag":145,"props":2912,"children":2913},{},[2914,2919,2924],{"type":39,"tag":172,"props":2915,"children":2916},{},[2917],{"type":44,"value":2918},"Telemetry Ingestion",{"type":39,"tag":172,"props":2920,"children":2921},{},[2922],{"type":44,"value":2923},"IoT Rules Engine to Timestream (Basic Ingest)",{"type":39,"tag":172,"props":2925,"children":2926},{},[2927],{"type":44,"value":2928},"Cost-effective time-series storage",{"type":39,"tag":145,"props":2930,"children":2931},{},[2932,2937,2942],{"type":39,"tag":172,"props":2933,"children":2934},{},[2935],{"type":44,"value":2936},"Device State",{"type":39,"tag":172,"props":2938,"children":2939},{},[2940],{"type":44,"value":2941},"Named Shadows (config + diagnostics)",{"type":39,"tag":172,"props":2943,"children":2944},{},[2945],{"type":44,"value":2946},"Offline-tolerant desired\u002Freported sync",{"type":39,"tag":145,"props":2948,"children":2949},{},[2950,2955,2960],{"type":39,"tag":172,"props":2951,"children":2952},{},[2953],{"type":44,"value":2954},"Edge Compute",{"type":39,"tag":172,"props":2956,"children":2957},{},[2958],{"type":44,"value":2959},"Greengrass v2 with Stream Manager",{"type":39,"tag":172,"props":2961,"children":2962},{},[2963],{"type":44,"value":2964},"Local filtering, buffered cloud upload",{"type":39,"tag":145,"props":2966,"children":2967},{},[2968,2972,2977],{"type":39,"tag":172,"props":2969,"children":2970},{},[2971],{"type":44,"value":2136},{"type":39,"tag":172,"props":2973,"children":2974},{},[2975],{"type":44,"value":2976},"Jobs (OTA) + Fleet Indexing + Device Defender",{"type":39,"tag":172,"props":2978,"children":2979},{},[2980],{"type":44,"value":2981},"Update, query, and audit the fleet",{"type":39,"tag":145,"props":2983,"children":2984},{},[2985,2990,2995],{"type":39,"tag":172,"props":2986,"children":2987},{},[2988],{"type":44,"value":2989},"Alerting",{"type":39,"tag":172,"props":2991,"children":2992},{},[2993],{"type":44,"value":2994},"IoT Events detector model to SNS",{"type":39,"tag":172,"props":2996,"children":2997},{},[2998],{"type":44,"value":2999},"Multi-device state correlation",{"type":39,"tag":40,"props":3001,"children":3002},{},[3003,3005,3011],{"type":44,"value":3004},"Include estimated monthly cost range using the ",{"type":39,"tag":69,"props":3006,"children":3008},{"className":3007},[],[3009],{"type":44,"value":3010},"cost-check",{"type":44,"value":3012}," skill.",{"type":39,"tag":3014,"props":3015,"children":3016},"style",{},[3017],{"type":44,"value":3018},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3020,"total":3116},[3021,3035,3050,3062,3072,3085,3101],{"slug":3022,"name":3022,"fn":3023,"description":3024,"org":3025,"tags":3026,"stars":22,"repoUrl":23,"updatedAt":3034},"agentcore","design Amazon Bedrock AgentCore architectures","Deep-dive into Amazon Bedrock AgentCore platform design, service selection, deployment, and production operations. This skill should be used when the user asks to \"design an AgentCore architecture\", \"deploy agents on AgentCore\", \"configure AgentCore Runtime\", \"set up AgentCore Memory\", \"use AgentCore Gateway\", \"configure AgentCore Identity\", \"set up AgentCore Policy\", \"plan agent observability\", \"evaluate agent quality\", \"move agent PoC to production\", or mentions AgentCore, AgentCore Runtime, AgentCore Memory, AgentCore Gateway, AgentCore Identity, AgentCore Policy, AgentCore Evaluations, AgentCore Code Interpreter, AgentCore Browser, A2A protocol, or multi-agent orchestration on AWS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3027,3030,3033],{"name":3028,"slug":3029,"type":15},"Agents","agents",{"name":3031,"slug":3032,"type":15},"Architecture","architecture",{"name":20,"slug":21,"type":15},"2026-07-12T08:40:11.108951",{"slug":3036,"name":3036,"fn":3037,"description":3038,"org":3039,"tags":3040,"stars":22,"repoUrl":23,"updatedAt":3049},"aidlc-lite","develop AI applications on AWS","Lightweight AI development lifecycle for building on AWS. A simplified take on the AI-DLC philosophy — think together, then build fast. Acts as a design partner that understands intent, proposes alternatives with trade-offs, and ships working code without the ceremony of full requirements\u002Fdesign\u002Fspec documents. Use when a founder says \"build X on AWS\", \"add Y to my stack\", \"scaffold an API\", or \"write the CDK for Z\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3041,3042,3045,3046],{"name":3028,"slug":3029,"type":15},{"name":3043,"slug":3044,"type":15},"AI Infrastructure","ai-infrastructure",{"name":20,"slug":21,"type":15},{"name":3047,"slug":3048,"type":15},"Engineering","engineering","2026-07-12T08:40:40.204103",{"slug":3051,"name":3051,"fn":3052,"description":3053,"org":3054,"tags":3055,"stars":22,"repoUrl":23,"updatedAt":3061},"architect-for-startups","advise on AWS architecture for startups","AWS architecture advisor tailored specifically for startups. Alters AWS architecture recommendations based on startup stage (pre-revenue through Series B+), team size, runway, and credits. ALWAYS use when asked about building on AWS, choosing services, planning infrastructure, managing costs with credits, or preparing architecture for fundraising.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3056,3057,3058],{"name":3031,"slug":3032,"type":15},{"name":20,"slug":21,"type":15},{"name":3059,"slug":3060,"type":15},"Strategy","strategy","2026-07-12T08:41:33.557354",{"slug":3063,"name":3063,"fn":3064,"description":3065,"org":3066,"tags":3067,"stars":22,"repoUrl":23,"updatedAt":3071},"aws-architect","design and review AWS architectures","Design and review AWS architectures following Well-Architected Framework principles. Use when planning new infrastructure, reviewing existing architectures, evaluating trade-offs between AWS services, or when asked about AWS best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3068,3069,3070],{"name":3031,"slug":3032,"type":15},{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T08:40:57.630086",{"slug":3073,"name":3073,"fn":3074,"description":3075,"org":3076,"tags":3077,"stars":22,"repoUrl":23,"updatedAt":3084},"aws-compare","compare AWS architecture options","Compare 2-3 AWS architecture options side-by-side across cost, complexity, performance, security, and operational burden. Use when evaluating trade-offs between approaches or when the user is deciding between options.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3078,3079,3080,3083],{"name":3031,"slug":3032,"type":15},{"name":20,"slug":21,"type":15},{"name":3081,"slug":3082,"type":15},"Cost Optimization","cost-optimization",{"name":1289,"slug":1286,"type":15},"2026-07-12T08:40:23.960287",{"slug":3086,"name":3086,"fn":3087,"description":3088,"org":3089,"tags":3090,"stars":22,"repoUrl":23,"updatedAt":3100},"aws-debug","debug AWS infrastructure and deployment failures","Debug AWS infrastructure issues, deployment failures, and runtime errors. Use when troubleshooting CloudFormation stack failures, Lambda errors, ECS task failures, permission issues, networking problems, or any AWS service misbehavior.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3091,3092,3095,3098],{"name":20,"slug":21,"type":15},{"name":3093,"slug":3094,"type":15},"Debugging","debugging",{"name":3096,"slug":3097,"type":15},"Deployment","deployment",{"name":3099,"slug":2752,"type":15},"Observability","2026-07-12T08:40:16.767171",{"slug":3102,"name":3102,"fn":3103,"description":3104,"org":3105,"tags":3106,"stars":22,"repoUrl":23,"updatedAt":3115},"aws-diagram","generate AWS architecture diagrams","Generate AWS architecture diagrams in Mermaid or ASCII from a description, existing IaC, or conversation context. Use when the user wants to visualize an architecture.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3107,3108,3109,3112],{"name":3031,"slug":3032,"type":15},{"name":20,"slug":21,"type":15},{"name":3110,"slug":3111,"type":15},"Diagrams","diagrams",{"name":3113,"slug":3114,"type":15},"Visualization","visualization","2026-07-12T08:40:43.26341",42,{"items":3118,"total":3289},[3119,3134,3154,3164,3177,3190,3200,3210,3229,3244,3259,3274],{"slug":3120,"name":3120,"fn":3121,"description":3122,"org":3123,"tags":3124,"stars":3131,"repoUrl":3132,"updatedAt":3133},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3125,3126,3127,3130],{"name":20,"slug":21,"type":15},{"name":3093,"slug":3094,"type":15},{"name":3128,"slug":3129,"type":15},"Logs","logs",{"name":3099,"slug":2752,"type":15},9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":3135,"name":3136,"fn":3137,"description":3138,"org":3139,"tags":3140,"stars":3131,"repoUrl":3132,"updatedAt":3153},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3141,3144,3145,3148,3151],{"name":3142,"slug":3143,"type":15},"Aurora","aurora",{"name":20,"slug":21,"type":15},{"name":3146,"slug":3147,"type":15},"Database","database",{"name":3149,"slug":3150,"type":15},"Serverless","serverless",{"name":3152,"slug":713,"type":15},"SQL","2026-07-12T08:36:45.053393",{"slug":3155,"name":3156,"fn":3137,"description":3138,"org":3157,"tags":3158,"stars":3131,"repoUrl":3132,"updatedAt":3163},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3159,3160,3161,3162],{"name":20,"slug":21,"type":15},{"name":3146,"slug":3147,"type":15},{"name":3149,"slug":3150,"type":15},{"name":3152,"slug":713,"type":15},"2026-07-12T08:36:42.694299",{"slug":3165,"name":3166,"fn":3137,"description":3138,"org":3167,"tags":3168,"stars":3131,"repoUrl":3132,"updatedAt":3176},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3169,3170,3171,3174,3175],{"name":20,"slug":21,"type":15},{"name":3146,"slug":3147,"type":15},{"name":3172,"slug":3173,"type":15},"Migration","migration",{"name":3149,"slug":3150,"type":15},{"name":3152,"slug":713,"type":15},"2026-07-12T08:36:38.584057",{"slug":3178,"name":3179,"fn":3137,"description":3138,"org":3180,"tags":3181,"stars":3131,"repoUrl":3132,"updatedAt":3189},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3182,3183,3184,3187,3188],{"name":20,"slug":21,"type":15},{"name":3146,"slug":3147,"type":15},{"name":3185,"slug":3186,"type":15},"PostgreSQL","postgresql",{"name":3149,"slug":3150,"type":15},{"name":3152,"slug":713,"type":15},"2026-07-12T08:36:46.530743",{"slug":3191,"name":3192,"fn":3137,"description":3138,"org":3193,"tags":3194,"stars":3131,"repoUrl":3132,"updatedAt":3199},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3195,3196,3197,3198],{"name":20,"slug":21,"type":15},{"name":3146,"slug":3147,"type":15},{"name":3149,"slug":3150,"type":15},{"name":3152,"slug":713,"type":15},"2026-07-12T08:36:48.104182",{"slug":3201,"name":3201,"fn":3137,"description":3138,"org":3202,"tags":3203,"stars":3131,"repoUrl":3132,"updatedAt":3209},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3204,3205,3206,3207,3208],{"name":20,"slug":21,"type":15},{"name":3146,"slug":3147,"type":15},{"name":3172,"slug":3173,"type":15},{"name":3149,"slug":3150,"type":15},{"name":3152,"slug":713,"type":15},"2026-07-12T08:36:36.374512",{"slug":3211,"name":3211,"fn":3212,"description":3213,"org":3214,"tags":3215,"stars":3226,"repoUrl":3227,"updatedAt":3228},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3216,3219,3222,3223],{"name":3217,"slug":3218,"type":15},"Accounting","accounting",{"name":3220,"slug":3221,"type":15},"Analytics","analytics",{"name":3081,"slug":3082,"type":15},{"name":3224,"slug":3225,"type":15},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":3230,"name":3230,"fn":3231,"description":3232,"org":3233,"tags":3234,"stars":3226,"repoUrl":3227,"updatedAt":3243},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3235,3236,3237,3240],{"name":20,"slug":21,"type":15},{"name":3224,"slug":3225,"type":15},{"name":3238,"slug":3239,"type":15},"Management","management",{"name":3241,"slug":3242,"type":15},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":3245,"name":3245,"fn":3246,"description":3247,"org":3248,"tags":3249,"stars":3226,"repoUrl":3227,"updatedAt":3258},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3250,3251,3252,3255],{"name":3220,"slug":3221,"type":15},{"name":3224,"slug":3225,"type":15},{"name":3253,"slug":3254,"type":15},"Financial Statements","financial-statements",{"name":3256,"slug":3257,"type":15},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":3260,"name":3260,"fn":3261,"description":3262,"org":3263,"tags":3264,"stars":3226,"repoUrl":3227,"updatedAt":3273},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3265,3268,3271],{"name":3266,"slug":3267,"type":15},"Automation","automation",{"name":3269,"slug":3270,"type":15},"Documents","documents",{"name":3272,"slug":3260,"type":15},"PDF","2026-07-12T08:41:44.135656",{"slug":3275,"name":3275,"fn":3276,"description":3277,"org":3278,"tags":3279,"stars":3226,"repoUrl":3227,"updatedAt":3288},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3280,3281,3284,3285],{"name":3217,"slug":3218,"type":15},{"name":3282,"slug":3283,"type":15},"Data Analysis","data-analysis",{"name":3224,"slug":3225,"type":15},{"name":3286,"slug":3287,"type":15},"KPI","kpi","2026-07-12T08:39:59.54971",150]