CloudFormation Bootstrap

Phase 1 shared infrastructure is deployed with CloudFormation — not TERRAFORM TERRAFORM
HashiCorp Terraform — provisions shared infrastructure (IoT rules fan-out, Lambda, DynamoDB, API Gateway, Amplify). and not per-device. This bootstrap creates the IoT rules IoT rules
AWS IoT Rules — route incoming MQTT messages to Lambda and CloudWatch Logs for ingest and verification. and CloudWatch CloudWatch
Amazon CloudWatch Logs — stores IoT rule output for Phase 1 verification (`/aws/iot/esp32-demo/telemetry` and `/events`). log groups used in Cloud Verification.

From the demo repository demo repository
esp32-aws-iot-demo — source repository for firmware, provisioning scripts, Terraform, and dashboard code. Commands run from its root unless stated otherwise. root, with AWS_REGION set (see Prerequisites):

export AWS_REGION=ap-southeast-2
./aws/provision-infra.sh

provision-infra.sh is also step 1 of ./aws/provision.sh on Device Provisioning.

Stack and template

Item	Value
Stack name	esp32-demo-phase1 ( Phase 1 stack Phase 1 stack CloudFormation stack `esp32-demo-phase1` — deploys Phase 1 IoT rules and CloudWatch log groups for pretest verification before Terraform. )
Template	aws/cloudformation/phase1-infra.yaml

Resources created

• CloudWatch Logs CloudWatch Logs
  Amazon CloudWatch Logs — stores IoT rule output for Phase 1 verification (`/aws/iot/esp32-demo/telemetry` and `/events`). groups: - /aws/iot/esp32-demo/telemetry - /aws/iot/esp32-demo/events - /aws/iot/esp32-demo/errors
• IoT rules IoT rules
  AWS IoT Rules — route incoming MQTT messages to Lambda and CloudWatch Logs for ingest and verification. : - esp32_demo_telemetry_rule
  • esp32_demo_events_rule
• IAM role for rule → CloudWatch delivery (see Policies and IAM)

Verify bootstrap

aws cloudformation describe-stacks --stack-name esp32-demo-phase1 --query 'Stacks[0].StackStatus'
aws iot get-topic-rule --rule-name esp32_demo_telemetry_rule --query 'rule.ruleDisabled'
aws iot get-topic-rule --rule-name esp32_demo_events_rule --query 'rule.ruleDisabled'

Expected: stack status CREATE_COMPLETE or UPDATE_COMPLETE; both ruleDisabled queries return false.

Phase 1 vs Phase 2

This CloudFormation bootstrap is what makes Phase 1 PRETEST PRETEST
Phase 1 verification flow — Prerequisites through Cloud Verification in the sidebar (includes AWS Provisioning). Proves device-to-cloud connectivity in CloudWatch before full Terraform rollout. CloudWatch verification work. Phase 2 terraform apply (see Terraform Provisioning) provisions the full serverless ingest and query stack.

If bootstrap fails or logs stay empty

• Confirm aws sts get-caller-identity works and your principal can create IoT, IAM, CloudFormation, and CloudWatch Logs resources in AWS_REGION.
• Re-run ./aws/provision-infra.sh if rules or log groups are missing.
• For partial infra teardown, see Teardown and Cleanup (INFRA_ONLY=1).