Security and access

#Every connection is encrypted

Devices connect over TLS: MQTT on port 8883 or MQTT over secure WebSocket on port 8443. Plain MQTT on 1883 is only for devices on a private network that can't do TLS, and only with a password.

#Two ways to sign in

Certificates have a status: Active, Inactive or Revoked. Deactivating a certificate stops new connections at once.

#Policies: least privilege by default

Get started gives each device a starter policy that lets it connect as itself and use only its own topics. You can write your own:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": ["iot:Connect"], "Resource": ["client/${iot:Connection.Thing.ThingName}"] },
    { "Effect": "Allow", "Action": ["iot:Publish"], "Resource": ["topic/tic/things/${iot:Connection.Thing.ThingName}/*"] },
    { "Effect": "Allow", "Action": ["iot:Subscribe", "iot:Receive"], "Resource": ["topicfilter/tic/things/${iot:Connection.Thing.ThingName}/commands/#", "topic/tic/things/${iot:Connection.Thing.ThingName}/commands/*"] }
  ]
}

Anything not allowed is denied. A Deny statement always wins over an Allow.

#Keys and secrets

• Private keys created by IoT Core are shown once at creation and never stored.
• Keep the private key on the device only; don't email it or put it in source control.
• Rotate certificates before they expire. The Overview and the device's Diagnose tab warn about certificates expiring within 30 days.

#Every decision has a reason

When a connection is refused or a publish is denied, IoT Core records why, for example CERT_REVOKED or a denied topic. See Device can't connect for every reason and its fix.