u-blox SARA-R422, SARA-R5 Application note

UBX-20044809 - R03
C1-Public www.u-blox.com

SARA-R422 / SARA-R5

Configure MQTT on AWS IoT core

Application note

Abstract

This document provides examples of how to use AT commands to connect the AWS IoT service with
u-blox SARA-R422S, SARA-R422M8S and SARA-R5 series modules.

SARA-R4

SARA-R422 / SARA-R5 - Application note

UBX-20044809 - R03 Document information Page 2 of 17
C1-Public

Document information

Title

SARA-R422 / SARA-R5

Subtitle

Configure MQTT on AWS IoT core

Document type

Application note

Document number

UBX-20044809

Revision and date

R03

29-Mar-2021

Disclosure restriction

C1-Public

This document applies to the following products:

Product name

SARA-R422S

SARA-R422M8S

SARA-R5 series

u-blox or third parties may hold intellectual property rights in the products, names, logos and designs included in this
document. Copying, reproduction, modification or disclosure to third parties of this document or any part thereof is only
permitted with the express written permission of u-blox.
The information contained herein is provided “as is” and u-blox assumes no liability for its use. No warranty, either express or
implied, is given, including but not limited to, with respect to the accuracy, correctness, reliability and fitness for a particular
purpose of the information. This document may be revised by u-blox at any time without notice. For the most recent
documents, visit www.u-blox.com.
Copyright © u-blox AG.

SARA-R422 / SARA-R5 - Application note

UBX-20044809 - R03 Contents Page 3 of 17
C1-Public

Contents

Document information ................................................................................................................................ 2

Contents .......................................................................................................................................................... 3

1 AWS IoT setup ........................................................................................................................................ 4

1.1 Policy creation .............................................................................................................................................. 4

1.2 Thing creation .............................................................................................................................................. 6

1.3 Attach policy to created thing .................................................................................................................. 9

2 u-blox module setup........................................................................................................................... 10

2.1 Store certificates in module file system ..............................................................................................10

2.1.1 AT commands procedure to store the file in the module .........................................................10

2.1.2 m-center procedure to store the file in the module ...................................................................10

2.2 Check CA, CC, and PK in the file system ..............................................................................................11

2.3 Certificates manager configuration ......................................................................................................11

2.4 Security profile configuration .................................................................................................................11

3 Example of MQTT session between module and AWS IoT ................................................... 12

3.1 Module setup: start a MQTT session and subscribe to a topic .......................................................12

3.2 Configure AWS IoT: subscribe to a topic..............................................................................................13

3.3 Module: publish a message to AWS IoT ...............................................................................................13

3.4 AWS IoT: read the received message ...................................................................................................14

3.5 AWS IoT: publish a message to module ...............................................................................................14

3.6 Module read the received message .......................................................................................................14

Appendix ....................................................................................................................................................... 15

A Glossary ................................................................................................................................................. 15

Related documentation ........................................................................................................................... 16

Revision history .......................................................................................................................................... 16

Contact .......................................................................................................................................................... 17

SARA-R422 / SARA-R5 - Application note

UBX-20044809 - R03 AWS IoT setup Page 4 of 17
C1-Public

1 AWS IoT setup

To get started with the Amazon Web Services (AWS) IoT service, it is necessary to set up the AWS
account and permissions. For details on how to create an AWS account, see the AWS official website
link:

https://aws.amazon.com/premiumsupport/knowledge-center/create-and-activate-aws-account/

Detailed instructions are available in sections Sign up for an AWS account and Create a user and
grant permissions at https://docs.aws.amazon.com/iot/latest/developerguide/setting-up.html.

For more details on the use of AT commands, see the SARA-R5 series AT commands manual [2] /
SARA-R4 series AT commands manual [6]. Further details on the IP data connection configuration
are available in the SARA-R4 / SARA-R5 IP applications development guide [4].

⚠ Due to AWS's continuous evolution, some information provided in this document can be not up to

date.

1.1 Policy creation

As a first step to set up an AWS connection, it is necessary to create a policy. From the AWS IoT Core
console at console.aws.amazon.com/iot, go to Secure > Policies, then click on Create. This will enable
the creation of a new policy that will be adopted in future devices.

Figure 1: AWS policy creation

SARA-R422 / SARA-R5 - Application note

UBX-20044809 - R03 AWS IoT setup Page 5 of 17
C1-Public

Then, on the next page, type a name for the new policy and type the required actions in the field Action
(e.g., iot:Publish, iot:Receive, iot:Subscribe) considering the resource identification reported in
the field Resource ARN.

Figure 2: Create a policy

Remember to check the Allow box. Multiple statements can be added in the same policy. Complete
the procedure by clicking Create. See a sample of a policy with two statements in the following script.

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iot:Publish",
"iot:Receive",
"iot:Subscribe"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "iot:Connect",
"Resource": "arn:aws:iot:us-east-1:XXXXXXXX:*"
}
]
}

SARA-R422 / SARA-R5 - Application note

UBX-20044809 - R03 AWS IoT setup Page 6 of 17
C1-Public

For non-dev environments, all devices in your fleet must have credentials with privileges that

authorize intended actions only, which include (but are not limited to) AWS IoT MQTT actions such
as publishing messages or subscribing to topics with specific scope and context. The specific
permission policies can vary for your use cases. Identify the permission policies that best meet
your business and security requirements.

For additional sample policies, refer to:

https://docs.aws.amazon.com/iot/latest/developerguide/example-iot-policies.html
https://docs.aws.amazon.com/iot/latest/developerguide/security-best-practices.html

1.2 Thing creation

As the next step, navigate to Manage > Things using the menu on the left-hand side of the AWS IoT
Core console and select Create to initialize a new “thing”.

On the page that follows, select Create a single thing and proceed. Here, insert a thing name in the
box; no further settings should be configured on this page. Complete the procedure by clicking Next.
For clarity, see the example shown in the image below:

Figure 3: Add your device to the thing registry