AWS IoT Core

# 1. A thing, a certificate, and a policy that limits it to its own topics
aws iot create-thing --thing-name pump-17
CERT_ARN=$(aws iot create-keys-and-certificate --set-as-active \
  --certificate-pem-outfile pump-17.crt --private-key-outfile pump-17.key \
  --query certificateArn --output text)

cat > policy.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "iot:Connect",
      "Resource": "arn:aws:iot:us-east-1:123456789012:client/${iot:Connection.Thing.ThingName}" },
    { "Effect": "Allow", "Action": "iot:Publish",
      "Resource": "arn:aws:iot:us-east-1:123456789012:topic/factory/${iot:Connection.Thing.ThingName}/*" }
  ]
}
EOF
aws iot create-policy --policy-name pump-policy --policy-document file://policy.json
aws iot attach-policy --policy-name pump-policy --target "$CERT_ARN"
aws iot attach-thing-principal --thing-name pump-17 --principal "$CERT_ARN"

# 2. A rule: readings above 80 go to a Lambda function
cat > rule.json <<'EOF'
{
  "sql": "SELECT topic(2) AS device, temp FROM 'factory/+/telemetry' WHERE temp > 80",
  "awsIotSqlVersion": "2016-03-23",
  "actions": [{ "lambda": { "functionArn": "arn:aws:lambda:us-east-1:123456789012:function:alert-on-heat" } }]
}
EOF
aws iot create-topic-rule --rule-name hot_pumps --topic-rule-payload file://rule.json
# (the function also needs `aws lambda add-permission` for iot.amazonaws.com)

# 3. Publish as the device over MQTT with its certificate
ENDPOINT=$(aws iot describe-endpoint --endpoint-type iot:Data-ATS \
  --query endpointAddress --output text)
mosquitto_pub -h "$ENDPOINT" -p 8883 --cafile AmazonRootCA1.pem \
  --cert pump-17.crt --key pump-17.key -i pump-17 -q 1 \
  -t factory/pump-17/telemetry -m '{"temp": 84.2}'

# Same rule through Basic Ingest: no broker, no messaging charge
# (the policy must also allow iot:Publish on topic/$aws/rules/hot_pumps/*)
mosquitto_pub -h "$ENDPOINT" -p 8883 --cafile AmazonRootCA1.pem \
  --cert pump-17.crt --key pump-17.key -i pump-17 -q 1 \
  -t '$aws/rules/hot_pumps/factory/pump-17/telemetry' -m '{"temp": 84.2}'