Skip to content

README.md

Latest commit

 

History

History
127 lines (105 loc) · 5.59 KB

README.md

File metadata and controls

127 lines (105 loc) · 5.59 KB

MQTT5 PKCS11 PubSub

Return to main sample list

Jump To:

Introduction

This sample uses the Message Broker for AWS IoT to send and receive messages through an MQTT connection using MQTT5 with PKCS#11 for certificate and private key operations.

You can read more about MQTT5 for the JavaScript IoT Device SDK V2 in the MQTT5 user guide.

Requirements

Important

TLS integration with PKCS#11 has the following limitations:

  • Only supported on Unix-like platforms
  • TLS 1.3 is not supported

This sample assumes you have the required AWS IoT resources available and a PKCS#11 compatible hardware security module (HSM) or software token. Information about AWS IoT can be found HERE and instructions on creating AWS IoT resources (AWS IoT Policy, Device Certificate, Private Key) can be found HERE.

Your IoT Core Thing's Policy must provide privileges for this sample to connect, subscribe, publish, and receive. Below is a sample policy that can be used on your IoT Core Thing that will allow this sample to run as intended.

(see sample policy) 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish",
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:region:account:topic/test/topic"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Subscribe"
      ],
      "Resource": [
        "arn:aws:iot:region:account:topicfilter/test/topic"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect"
      ],
      "Resource": [
        "arn:aws:iot:region:account:client/mqtt5-sample-*"
      ]
    }
  ]
}

Replace with the following with the data from your AWS account:

  • <region>: The AWS IoT Core region where you created your AWS IoT Core thing you wish to use with this sample. For example us-east-1.
  • <account>: Your AWS IoT Core account ID. This is the set of numbers in the top right next to your AWS account name when using the AWS IoT Core website.

Note that in a real application, you may want to avoid the use of wildcards in your ClientID or use them selectively. Please follow best practices when working with AWS on production applications using the SDK. Also, for the purposes of this sample, please make sure your policy allows a client ID of mqtt5-sample-* to connect or use --client_id <client ID here> to send the client ID your policy supports.

How to run

To Run this sample from the samples/node/mqtt/mqtt5_pkcs11 folder, use the following command:

npm install
node dist/index.js \
  --endpoint <AWS IoT endpoint> \
  --cert <Path to certificate file> \
  --pkcs11_lib <Path to PKCS#11 library> \
  --pin <User PIN>

If you would like to see what optional arguments are available, use the --help argument:

node dist/index.js --help

will result in the following output:

Options:
      --version      Show version number                               [boolean]
  -e, --endpoint     IoT endpoint hostname                   [string] [required]
  -c, --cert         Path to the certificate file to use during mTLS connection
                     establishment                           [string] [required]
  -l, --pkcs11_lib   Path to PKCS#11 Library                 [string] [required]
  -p, --pin          User PIN for logging into PKCS#11 token [string] [required]
  -t, --token_label  Label of the PKCS#11 token to use (optional)       [string]
  -s, --slot_id      Slot ID containing the PKCS#11 token to use (optional)
                                                                        [number]
  -k, --key_label    Label of private key on the PKCS#11 token (optional)
                                                                        [string]
  -C, --client_id    Client ID       [string] [default: "mqtt5-sample-51efd3cc"]
  -T, --topic        Topic                      [string] [default: "test/topic"]
  -m, --message      Message payload
                                   [string] [default: "Hello from mqtt5 sample"]
  -n, --count        Messages to publish (0 = infinite)    [number] [default: 5]
      --help         Show help                                         [boolean]

The sample will not run without the required arguments and will notify you of missing arguments.

Additional Information

Additional help with the MQTT5 Client can be found in the MQTT5 Userguide. This guide will provide more details on MQTT5 operations, lifecycle events, connection methods, and other useful information.

⚠️ Usage disclaimer

These code examples interact with services that may incur charges to your AWS account. For more information, see AWS Pricing.

Additionally, example code might theoretically modify or delete existing AWS resources. As a matter of due diligence, do the following:

  • Be aware of the resources that these examples create or delete.
  • Be aware of the costs that might be charged to your account as a result.
  • Back up your important data.