Skip to content
AWS IoT Walkthrough

Device Provisioning

Register a per-device THING
AWS IoT Thing — logical device identity (example: `esp32-c`) bound to certificates and MQTT topics. , certificate, and IoT policy
AWS IoT Core policy — least-privilege MQTT permissions scoped to a device's Thing name and topic namespace. , then produce firmware build inputs. Requires CloudFormation Bootstrap (or an existing Phase 1 stack
CloudFormation stack `esp32-demo-phase1` — deploys Phase 1 IoT rules and CloudWatch log groups for pretest verification before Terraform. ) first.

Full provisioning flow

Section titled “Full provisioning flow”

From the demo repository
esp32-aws-iot-demo — source repository for firmware, provisioning scripts, Terraform, and dashboard code. Commands run from its root unless stated otherwise. root:

Terminal window
export WIFI_SSID="your-ssid"
export WIFI_PASSWORD="your-password"
export THING_NAME="esp32-c"
export AWS_REGION=ap-southeast-2


./aws/provision.sh
./scripts/generate-headers.sh

provision.sh runs in order:

  1. provision-infra.sh — CloudFormation bootstrap (skipped if stack already exists)
  2. provision-device.sh — Thing, certificate, policy, local PEM files

If bootstrap is already done, run device provisioning only:

Terminal window
./aws/provision-device.sh
./scripts/generate-headers.sh

Outputs

Section titled “Outputs”
  • PEM files in firmware/certs/ (gitignored)
  • AWS_IOT_ENDPOINT=... printed to stdout
  • After generate-headers.sh:
    • firmware/include/config.h — Wi-Fi, thing name, endpoint, publish interval
    • firmware/include/certs.h — PEM material for the build

generate-headers.sh requires WIFI_SSID, WIFI_PASSWORD, and THING_NAME.

For TLS model and PEM handling practices, see Certificate Provisioning. For how headers are used in the build, see Build Configuration.