Skip to content

Commit 7445d11

Browse files
author
AWS
committed
AWS IoT Update: This release adds support for Custom Authentication with X.509 Client Certificates, support for Custom Client Certificate validation, and support for selecting application protocol and authentication type without requiring TLS ALPN for customer's AWS IoT Domain Configurations.
1 parent 6888807 commit 7445d11

File tree

2 files changed

+89
-13
lines changed

2 files changed

+89
-13
lines changed

‎.changes/next-release/feature-AWSIoT-68b5144.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "AWS IoT",
4+
"contributor": "",
5+
"description": "This release adds support for Custom Authentication with X.509 Client Certificates, support for Custom Client Certificate validation, and support for selecting application protocol and authentication type without requiring TLS ALPN for customer's AWS IoT Domain Configurations."
6+
}

‎services/iot/src/main/resources/codegen-resources/service-2.json

Lines changed: 83 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@
8080
{"shape":"ServiceQuotaExceededException"},
8181
{"shape":"ResourceNotFoundException"}
8282
],
83-
"documentation":"<p>Associates a software bill of materials (SBOM) with a specific software package version.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">AssociateSbomWithPackageVersion</a> action.</p>",
83+
"documentation":"<p>Associates the selected software bill of materials (SBOM) with a specific software package version.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">AssociateSbomWithPackageVersion</a> action.</p>",
8484
"idempotent":true
8585
},
8686
"AssociateTargetsWithJob":{
@@ -358,7 +358,7 @@
358358
{"shape":"ThrottlingException"},
359359
{"shape":"InternalFailureException"}
360360
],
361-
"documentation":"<p>Creates a billing group.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">CreateBillingGroup</a> action.</p>"
361+
"documentation":"<p>Creates a billing group. If this call is made multiple times using the same billing group name and configuration, the call will succeed. If this call is made with the same billing group name but different configuration a <code>ResourceAlreadyExistsException</code> is thrown.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">CreateBillingGroup</a> action.</p>"
362362
},
363363
"CreateCertificateFromCsr":{
364364
"name":"CreateCertificateFromCsr",
@@ -731,7 +731,7 @@
731731
{"shape":"ServiceUnavailableException"},
732732
{"shape":"InternalFailureException"}
733733
],
734-
"documentation":"<p>Creates a role alias.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">CreateRoleAlias</a> action.</p>"
734+
"documentation":"<p>Creates a role alias.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">CreateRoleAlias</a> action.</p> <important> <p>The value of <a href=\"https://docs.aws.amazon.com/iot/latest/apireference/API_CreateRoleAlias.html#iot-CreateRoleAlias-request-credentialDurationSeconds\"> <code>credentialDurationSeconds</code> </a> must be less than or equal to the maximum session duration of the IAM role that the role alias references. For more information, see <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-managingrole-editing-api.html#roles-modify_max-session-duration-api\"> Modifying a role maximum session duration (Amazon Web Services API)</a> from the Amazon Web Services Identity and Access Management User Guide.</p> </important>"
735735
},
736736
"CreateScheduledAudit":{
737737
"name":"CreateScheduledAudit",
@@ -837,7 +837,7 @@
837837
{"shape":"InternalFailureException"},
838838
{"shape":"ResourceAlreadyExistsException"}
839839
],
840-
"documentation":"<p>Creates a new thing type.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">CreateThingType</a> action.</p>"
840+
"documentation":"<p>Creates a new thing type. If this call is made multiple times using the same thing type name and configuration, the call will succeed. If this call is made with the same thing type name but different configuration a <code>ResourceAlreadyExistsException</code> is thrown. </p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">CreateThingType</a> action.</p>"
841841
},
842842
"CreateTopicRule":{
843843
"name":"CreateTopicRule",
@@ -2140,7 +2140,7 @@
21402140
{"shape":"ValidationException"},
21412141
{"shape":"ResourceNotFoundException"}
21422142
],
2143-
"documentation":"<p>Disassociates a software bill of materials (SBOM) from a specific software package version.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">DisassociateSbomWithPackageVersion</a> action.</p>",
2143+
"documentation":"<p>Disassociates the selected software bill of materials (SBOM) from a specific software package version.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">DisassociateSbomWithPackageVersion</a> action.</p>",
21442144
"idempotent":true
21452145
},
21462146
"EnableTopicRule":{
@@ -4290,7 +4290,7 @@
42904290
{"shape":"ServiceUnavailableException"},
42914291
{"shape":"InternalFailureException"}
42924292
],
4293-
"documentation":"<p>Updates a role alias.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">UpdateRoleAlias</a> action.</p>"
4293+
"documentation":"<p>Updates a role alias.</p> <p>Requires permission to access the <a href=\"https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions\">UpdateRoleAlias</a> action.</p> <important> <p>The value of <a href=\"https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateRoleAlias.html#iot-UpdateRoleAlias-request-credentialDurationSeconds\"> <code>credentialDurationSeconds</code> </a> must be less than or equal to the maximum session duration of the IAM role that the role alias references. For more information, see <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-managingrole-editing-api.html#roles-modify_max-session-duration-api\"> Modifying a role maximum session duration (Amazon Web Services API)</a> from the Amazon Web Services Identity and Access Management User Guide.</p> </important>"
42944294
},
42954295
"UpdateScheduledAudit":{
42964296
"name":"UpdateScheduledAudit",
@@ -4833,6 +4833,15 @@
48334833
},
48344834
"documentation":"<p>Contains information that allowed the authorization.</p>"
48354835
},
4836+
"ApplicationProtocol":{
4837+
"type":"string",
4838+
"enum":[
4839+
"SECURE_MQTT",
4840+
"MQTT_WSS",
4841+
"HTTPS",
4842+
"DEFAULT"
4843+
]
4844+
},
48364845
"ApproximateSecondsBeforeTimedOut":{"type":"long"},
48374846
"AscendingOrder":{"type":"boolean"},
48384847
"AssetId":{"type":"string"},
@@ -4961,7 +4970,7 @@
49614970
"sbom":{"shape":"Sbom"},
49624971
"sbomValidationStatus":{
49634972
"shape":"SbomValidationStatus",
4964-
"documentation":"<p>The status of the initial validation for the SBOM against the Software Package Data Exchange (SPDX) and CycloneDX industry standard format.</p>"
4973+
"documentation":"<p>The status of the initial validation for the software bill of materials against the Software Package Data Exchange (SPDX) and CycloneDX industry standard formats.</p>"
49654974
}
49664975
}
49674976
},
@@ -5566,6 +5575,16 @@
55665575
"type":"list",
55675576
"member":{"shape":"AuthResult"}
55685577
},
5578+
"AuthenticationType":{
5579+
"type":"string",
5580+
"enum":[
5581+
"CUSTOM_AUTH_X509",
5582+
"CUSTOM_AUTH",
5583+
"AWS_X509",
5584+
"AWS_SIGV4",
5585+
"DEFAULT"
5586+
]
5587+
},
55695588
"AuthorizerArn":{
55705589
"type":"string",
55715590
"max":2048
@@ -6524,6 +6543,21 @@
65246543
"members":{
65256544
}
65266545
},
6546+
"ClientCertificateCallbackArn":{
6547+
"type":"string",
6548+
"max":2048,
6549+
"pattern":"[\\s\\S]*"
6550+
},
6551+
"ClientCertificateConfig":{
6552+
"type":"structure",
6553+
"members":{
6554+
"clientCertificateCallbackArn":{
6555+
"shape":"ClientCertificateCallbackArn",
6556+
"documentation":"<p>The ARN of the Lambda function that IoT invokes after mutual TLS authentication during the connection.</p>"
6557+
}
6558+
},
6559+
"documentation":"<p>An object that specifies the client certificate configuration for a domain.</p>"
6560+
},
65276561
"ClientId":{"type":"string"},
65286562
"ClientProperties":{
65296563
"type":"map",
@@ -7123,6 +7157,18 @@
71237157
"serverCertificateConfig":{
71247158
"shape":"ServerCertificateConfig",
71257159
"documentation":"<p>The server certificate configuration.</p>"
7160+
},
7161+
"authenticationType":{
7162+
"shape":"AuthenticationType",
7163+
"documentation":"<p>An enumerated string that specifies the authentication type.</p> <ul> <li> <p> <code>CUSTOM_AUTH_X509</code> - Use custom authentication and authorization with additional details from the X.509 client certificate.</p> </li> </ul> <ul> <li> <p> <code>CUSTOM_AUTH</code> - Use custom authentication and authorization. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/custom-authentication.html\">Custom authentication and authorization</a>.</p> </li> </ul> <ul> <li> <p> <code>AWS_X509</code> - Use X.509 client certificates without custom authentication and authorization. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html\">X.509 client certificates</a>.</p> </li> </ul> <ul> <li> <p> <code>AWS_SIGV4</code> - Use Amazon Web Services Signature Version 4. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/custom-authentication.html\">IAM users, groups, and roles</a>.</p> </li> </ul> <ul> <li> <p> <code>DEFAULT</code> - Use a combination of port and Application Layer Protocol Negotiation (ALPN) to specify authentication type. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html\">Device communication protocols</a>.</p> </li> </ul>"
7164+
},
7165+
"applicationProtocol":{
7166+
"shape":"ApplicationProtocol",
7167+
"documentation":"<p>An enumerated string that specifies the application-layer protocol.</p> <ul> <li> <p> <code>SECURE_MQTT</code> - MQTT over TLS.</p> </li> </ul> <ul> <li> <p> <code>MQTT_WSS</code> - MQTT over WebSocket.</p> </li> </ul> <ul> <li> <p> <code>HTTPS</code> - HTTP over TLS.</p> </li> </ul> <ul> <li> <p> <code>DEFAULT</code> - Use a combination of port and Application Layer Protocol Negotiation (ALPN) to specify application_layer protocol. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html\">Device communication protocols</a>.</p> </li> </ul>"
7168+
},
7169+
"clientCertificateConfig":{
7170+
"shape":"ClientCertificateConfig",
7171+
"documentation":"<p>An object that specifies the client certificate configuration for a domain.</p>"
71267172
}
71277173
}
71287174
},
@@ -7672,7 +7718,7 @@
76727718
},
76737719
"recipe":{
76747720
"shape":"PackageVersionRecipe",
7675-
"documentation":"<p>The inline job document associated with a software package version used for a quick job deployment via IoT Jobs.</p>"
7721+
"documentation":"<p>The inline job document associated with a software package version used for a quick job deployment.</p>"
76767722
},
76777723
"tags":{
76787724
"shape":"TagMap",
@@ -9610,6 +9656,18 @@
96109656
"serverCertificateConfig":{
96119657
"shape":"ServerCertificateConfig",
96129658
"documentation":"<p>The server certificate configuration.</p>"
9659+
},
9660+
"authenticationType":{
9661+
"shape":"AuthenticationType",
9662+
"documentation":"<p>An enumerated string that specifies the authentication type.</p> <ul> <li> <p> <code>CUSTOM_AUTH_X509</code> - Use custom authentication and authorization with additional details from the X.509 client certificate.</p> </li> </ul> <ul> <li> <p> <code>CUSTOM_AUTH</code> - Use custom authentication and authorization. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/custom-authentication.html\">Custom authentication and authorization</a>.</p> </li> </ul> <ul> <li> <p> <code>AWS_X509</code> - Use X.509 client certificates without custom authentication and authorization. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html\">X.509 client certificates</a>.</p> </li> </ul> <ul> <li> <p> <code>AWS_SIGV4</code> - Use Amazon Web Services Signature Version 4. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/custom-authentication.html\">IAM users, groups, and roles</a>.</p> </li> </ul> <ul> <li> <p> <code>DEFAULT</code> - Use a combination of port and Application Layer Protocol Negotiation (ALPN) to specify authentication type. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html\">Device communication protocols</a>.</p> </li> </ul>"
9663+
},
9664+
"applicationProtocol":{
9665+
"shape":"ApplicationProtocol",
9666+
"documentation":"<p>An enumerated string that specifies the application-layer protocol.</p> <ul> <li> <p> <code>SECURE_MQTT</code> - MQTT over TLS.</p> </li> </ul> <ul> <li> <p> <code>MQTT_WSS</code> - MQTT over WebSocket.</p> </li> </ul> <ul> <li> <p> <code>HTTPS</code> - HTTP over TLS.</p> </li> </ul> <ul> <li> <p> <code>DEFAULT</code> - Use a combination of port and Application Layer Protocol Negotiation (ALPN) to specify application_layer protocol. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html\">Device communication protocols</a>.</p> </li> </ul>"
9667+
},
9668+
"clientCertificateConfig":{
9669+
"shape":"ClientCertificateConfig",
9670+
"documentation":"<p>An object that specifies the client certificate configuration for a domain.</p>"
96139671
}
96149672
}
96159673
},
@@ -11740,7 +11798,7 @@
1174011798
},
1174111799
"recipe":{
1174211800
"shape":"PackageVersionRecipe",
11743-
"documentation":"<p>The inline job document associated with a software package version used for a quick job deployment via IoT Jobs.</p>"
11801+
"documentation":"<p>The inline job document associated with a software package version used for a quick job deployment.</p>"
1174411802
}
1174511803
}
1174611804
},
@@ -16458,7 +16516,7 @@
1645816516
"members":{
1645916517
"s3Location":{"shape":"S3Location"}
1646016518
},
16461-
"documentation":"<p>The Amazon S3 location for the artifacts associated with a software package version.</p>"
16519+
"documentation":"<p>A specific package version artifact associated with a software package version.</p>"
1646216520
},
1646316521
"PackageVersionErrorReason":{"type":"string"},
1646416522
"PackageVersionRecipe":{
@@ -17671,7 +17729,7 @@
1767117729
"members":{
1767217730
"s3Location":{"shape":"S3Location"}
1767317731
},
17674-
"documentation":"<p>The Amazon S3 location for the software bill of materials associated with a software package version.</p>"
17732+
"documentation":"<p>A specific software bill of matrerials associated with a software package version.</p>"
1767517733
},
1767617734
"SbomValidationErrorCode":{
1767717735
"type":"string",
@@ -19018,7 +19076,7 @@
1901819076
},
1901919077
"thingGroupNames":{
1902019078
"shape":"ThingGroupNameList",
19021-
"documentation":"<p>Thing group names.</p>"
19079+
"documentation":"<p>Thing group and billing group names.</p>"
1902219080
},
1902319081
"attributes":{
1902419082
"shape":"Attributes",
@@ -20143,6 +20201,18 @@
2014320201
"serverCertificateConfig":{
2014420202
"shape":"ServerCertificateConfig",
2014520203
"documentation":"<p>The server certificate configuration.</p>"
20204+
},
20205+
"authenticationType":{
20206+
"shape":"AuthenticationType",
20207+
"documentation":"<p>An enumerated string that specifies the authentication type.</p> <ul> <li> <p> <code>CUSTOM_AUTH_X509</code> - Use custom authentication and authorization with additional details from the X.509 client certificate.</p> </li> </ul> <ul> <li> <p> <code>CUSTOM_AUTH</code> - Use custom authentication and authorization. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/custom-authentication.html\">Custom authentication and authorization</a>.</p> </li> </ul> <ul> <li> <p> <code>AWS_X509</code> - Use X.509 client certificates without custom authentication and authorization. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html\">X.509 client certificates</a>.</p> </li> </ul> <ul> <li> <p> <code>AWS_SIGV4</code> - Use Amazon Web Services Signature Version 4. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/custom-authentication.html\">IAM users, groups, and roles</a>.</p> </li> </ul> <ul> <li> <p> <code>DEFAULT </code> - Use a combination of port and Application Layer Protocol Negotiation (ALPN) to specify authentication type. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html\">Device communication protocols</a>.</p> </li> </ul>"
20208+
},
20209+
"applicationProtocol":{
20210+
"shape":"ApplicationProtocol",
20211+
"documentation":"<p>An enumerated string that specifies the application-layer protocol.</p> <ul> <li> <p> <code>SECURE_MQTT</code> - MQTT over TLS.</p> </li> </ul> <ul> <li> <p> <code>MQTT_WSS</code> - MQTT over WebSocket.</p> </li> </ul> <ul> <li> <p> <code>HTTPS</code> - HTTP over TLS.</p> </li> </ul> <ul> <li> <p> <code>DEFAULT</code> - Use a combination of port and Application Layer Protocol Negotiation (ALPN) to specify application_layer protocol. For more information, see <a href=\"https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html\">Device communication protocols</a>.</p> </li> </ul>"
20212+
},
20213+
"clientCertificateConfig":{
20214+
"shape":"ClientCertificateConfig",
20215+
"documentation":"<p>An object that specifies the client certificate configuration for a domain.</p>"
2014620216
}
2014720217
}
2014820218
},
@@ -20455,7 +20525,7 @@
2045520525
},
2045620526
"recipe":{
2045720527
"shape":"PackageVersionRecipe",
20458-
"documentation":"<p>The inline job document associated with a software package version used for a quick job deployment via IoT Jobs.</p>"
20528+
"documentation":"<p>The inline job document associated with a software package version used for a quick job deployment.</p>"
2045920529
},
2046020530
"clientToken":{
2046120531
"shape":"ClientToken",

0 commit comments

Comments
 (0)