{"id":17330022,"url":"https://github.com/coderbyheart/aws-iot-device-credentials-workaround","last_synced_at":"2026-04-18T00:32:06.458Z","repository":{"id":138002294,"uuid":"549479994","full_name":"coderbyheart/aws-iot-device-credentials-workaround","owner":"coderbyheart","description":"Demonstrate how to use fleet provisioning via non-standard MQTT API to circumvent the 2k buffer size limit in the nRF9160 modem","archived":false,"fork":false,"pushed_at":"2022-10-11T13:22:32.000Z","size":158,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"saga","last_synced_at":"2025-10-23T20:49:36.935Z","etag":null,"topics":["aws","cellulariot","iot","nrf9160","typescript"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/coderbyheart.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-10-11T08:47:17.000Z","updated_at":"2022-10-11T08:48:07.000Z","dependencies_parsed_at":null,"dependency_job_id":"76dffe18-d5b1-4ff9-810f-ebb7c659549d","html_url":"https://github.com/coderbyheart/aws-iot-device-credentials-workaround","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/coderbyheart/aws-iot-device-credentials-workaround","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderbyheart%2Faws-iot-device-credentials-workaround","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderbyheart%2Faws-iot-device-credentials-workaround/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderbyheart%2Faws-iot-device-credentials-workaround/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderbyheart%2Faws-iot-device-credentials-workaround/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/coderbyheart","download_url":"https://codeload.github.com/coderbyheart/aws-iot-device-credentials-workaround/tar.gz/refs/heads/saga","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderbyheart%2Faws-iot-device-credentials-workaround/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31951291,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-17T17:29:20.459Z","status":"ssl_error","status_checked_at":"2026-04-17T17:28:47.801Z","response_time":62,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cellulariot","iot","nrf9160","typescript"],"created_at":"2024-10-15T14:50:07.949Z","updated_at":"2026-04-18T00:32:06.382Z","avatar_url":"https://github.com/coderbyheart.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-iot-device-credentials-workaround\n\nDemonstrate how to use fleet provisioning via non-standard MQTT API to\ncircumvent the 2k buffer size limit in the nRF9160 modem\n\n## Authenticate against AWS\n\nFor example using direnv, export these environment variables\n\n```bash\nexport AWS_ACCESS_KEY_ID=...\nexport AWS_SECRET_ACCESS_KEY=...\nexport AWS_REGION=...\n```\n\n## Deploy the solution\n\n```bash\nnpm ci\nnpx cdk bootstrap # Only needed once per AWS account and region\nnpx cdk deploy\n```\n\n## Create provisioning credentials\n\nThese credentials are to be used for the provisioning only, they cannot be used\nfor regular AWS IoT thing operations. They are intended to be provisioned to\nmany devices.\n\nRun this command to create a new set of credentials, and attach\n[the policy that allows devices to request new certificates](./cdk/resources/UnprovisionedCertificatePolicy.ts):\n\n```bash\nnpx tsx create-provision-certificate.ts\n```\n\n## Provision a device\n\nRun the command to connect using the provisioning credentials created above:\n\n```bash\nnpx tsx provision.ts \u003ccertificate ID\u003e\n```\n\nThis will connect to the AWS IoT broker using a random device ID, and publish a\nblank message to the topic `certificate/${deviceId}/create`.\n([Source](./device/provision.ts))\n\nThe [lambda function](./lambda/createCertificates.ts) that receives this\nmessage, will create a new certificate and keypair, attach\n[the policy for provisioned devices](./cdk/resources/ProvisionedCertificatePolicy.ts)\nto the certificate, create a Thing for the device, and attach the certificate to\nthe Thing.\n\nIt then publishes the private key on the topic\n`certificate/${deviceId}/create/accepted/key`, and the certificate on the topic\n`certificate/${deviceId}/create/accepted/cert`.\n\n\u003e **Warning**  \n\u003e The messages can be received by any client that has access to the provisioning\n\u003e credentials. If these credentials are compromised, an attacker can acquire new\n\u003e valid credentials to connect as a trusted device, and prevent genuine devices\n\u003e from connecting.\n\n## Connect using provisioned credentials\n\nFinally, run this command to connect with credentials created during the\nprovisioning step:\n\n```bash\nnpx tsx connect.ts \u003cdevice ID\u003e\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoderbyheart%2Faws-iot-device-credentials-workaround","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcoderbyheart%2Faws-iot-device-credentials-workaround","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoderbyheart%2Faws-iot-device-credentials-workaround/lists"}