How to Connect a Device to AWS IoT: Step-by-Step Guide

To connect a device to AWS IoT, you first create a thing and generate security certificates in AWS IoT Core. Then, use the MQTT protocol with the device's certificates to securely connect and communicate with AWS IoT endpoints.

Syntax

Connecting a device to AWS IoT involves these key parts:

• Thing: A digital representation of your device in AWS IoT.
• Certificates: Security credentials (X.509) to authenticate the device.
• MQTT Client: The device software that connects using MQTT protocol.
• AWS IoT Endpoint: The URL your device connects to.

The connection syntax in code typically looks like this:

javascript

mqttClient.connect({
  host: '<AWS_IOT_ENDPOINT>',
  port: 8883,
  protocol: 'mqtts',
  key: '<PRIVATE_KEY>',
  cert: '<DEVICE_CERTIFICATE>',
  ca: '<AWS_ROOT_CA>',
  clientId: '<THING_NAME>'
});

Example

This example shows how to connect a device using Node.js MQTT client to AWS IoT Core securely.

javascript

const awsIot = require('aws-iot-device-sdk');

const device = awsIot.device({
  keyPath: 'private.pem.key',
  certPath: 'certificate.pem.crt',
  caPath: 'AmazonRootCA1.pem',
  clientId: 'MyThing',
  host: 'your-endpoint.iot.region.amazonaws.com'
});

device.on('connect', () => {
  console.log('Connected to AWS IoT');
  device.subscribe('topic/test');
  device.publish('topic/test', JSON.stringify({ message: 'Hello from device' }));
});

device.on('message', (topic, payload) => {
  console.log('Message received:', topic, payload.toString());
});

Output

Connected to AWS IoT
Message received: topic/test {"message":"Hello from device"}

Common Pitfalls

• Missing or incorrect certificates: Devices must use valid X.509 certificates issued by AWS IoT.
• Wrong endpoint: Use the correct AWS IoT endpoint for your region.
• Port and protocol: Use port 8883 with MQTT over TLS (mqtts).
• Policy permissions: Attach an IoT policy to the certificate allowing connect, publish, subscribe actions.
• Clock skew: Device time must be accurate for TLS handshake.

javascript

/* Wrong way: Missing certificate */
mqttClient.connect({
  host: '<AWS_IOT_ENDPOINT>',
  port: 8883,
  protocol: 'mqtts'
});

/* Right way: Include certificates */
mqttClient.connect({
  host: '<AWS_IOT_ENDPOINT>',
  port: 8883,
  protocol: 'mqtts',
  key: '<PRIVATE_KEY>',
  cert: '<DEVICE_CERTIFICATE>',
  ca: '<AWS_ROOT_CA>'
});

Quick Reference

• Create a thing in AWS IoT Core.
• Generate and download device certificates and keys.
• Attach an IoT policy to the certificate.
• Use MQTT client with TLS to connect to AWS IoT endpoint.
• Subscribe and publish to MQTT topics as needed.

Key Takeaways

Always use X.509 certificates issued by AWS IoT for secure device authentication.

Connect devices using MQTT over TLS on port 8883 to the correct AWS IoT endpoint.

Attach proper IoT policies to certificates to allow device actions.

Ensure device system time is accurate to avoid TLS handshake failures.

Test connection by subscribing and publishing to MQTT topics after connecting.