Policies and IAM

IoT policy scope

Use least-privilege IoT policy IoT policy
AWS IoT Core policy — least-privilege MQTT permissions scoped to a device's Thing name and topic namespace. statements for device operations:

• iot:Connect scoped to the device ThingName identity
• iot:Publish scoped to the device topic namespace only

Recommended topic pattern:

• devices/{Thing_Name}/telemetry
• devices/{Thing_Name}/events

IoT Rules IAM role

IoT Rules IoT Rules
AWS IoT Rules — route incoming MQTT messages to Lambda and CloudWatch Logs for ingest and verification. write routed payloads to CloudWatch Logs CloudWatch Logs
Amazon CloudWatch Logs — stores IoT rule output for Phase 1 verification (`/aws/iot/esp32-demo/telemetry` and `/events`). for verification and troubleshooting. The IAM role for rule delivery is created by the CloudFormation bootstrap stack. Keep role permissions restricted to logs write operations, at minimum:

• logs:CreateLogGroup
• logs:CreateLogStream
• logs:PutLogEvents

Browser access boundary

The dashboard browser should not query DYNAMODB DYNAMODB
Amazon DynamoDB — persists telemetry and event records after Lambda ingest in Phase 2. directly. Data is intentionally fronted through API Gateway API Gateway
Amazon API Gateway — exposes HTTP routes for latest telemetry and recent events. The browser reads data through API Gateway, not DynamoDB directly. and LAMBDA LAMBDA
AWS Lambda — processes IoT rule payloads and serves query API logic behind API Gateway. so:

• data access can be validated and filtered at the API layer
• table internals remain private from client-side code
• IAM IAM
  AWS Identity and Access Management — controls roles and permissions for IoT Rules, Lambda, and other services. complexity stays server-side