AWS IoT Construct Library

Version 2.274.0-alpha.0

Separate package

@aws-cdk/aws-iot-alpha is not part of aws-cdk-lib — install it separately:

npm install @aws-cdk/aws-iot-alpha
pip install aws-cdk.aws-iot-alpha

This module is experimental (alpha): its API may change in any release, without a major version bump.

cdk-constructs: Experimental

The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

AWS IoT Core lets you connect billions of IoT devices and route trillions of messages to AWS services without managing infrastructure.

`TopicRule`

Create a topic rule that give your devices the ability to interact with AWS services. You can create a topic rule with an action that invoke the Lambda action as following:

const func = new lambda.Function(this, 'MyFunction', {
  runtime: lambda.Runtime.NODEJS_LATEST,
  handler: 'index.handler',
  code: lambda.Code.fromInline(`
    exports.handler = (event) => {
      console.log("It is test for lambda action of AWS IoT Rule.", event);
    };`
  ),
});

new iot.TopicRule(this, 'TopicRule', {
  topicRuleName: 'MyTopicRule', // optional
  description: 'invokes the lambda function', // optional
  sql: iot.IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
  actions: [new actions.LambdaFunctionAction(func)],
});

python

func = lambda_.Function(self, "MyFunction",
    runtime=lambda_.Runtime.NODEJS_LATEST,
    handler="index.handler",
    code=lambda_.Code.from_inline("""
            exports.handler = (event) => {
              console.log("It is test for lambda action of AWS IoT Rule.", event);
            };""")
)

iot.TopicRule(self, "TopicRule",
    topic_rule_name="MyTopicRule",  # optional
    description="invokes the lambda function",  # optional
    sql=iot.IotSql.from_string_as_ver20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
    actions=[actions.LambdaFunctionAction(func)]
)

java

Function func = Function.Builder.create(this, "MyFunction")
        .runtime(Runtime.NODEJS_LATEST)
        .handler("index.handler")
        .code(Code.fromInline("\n    exports.handler = (event) => {\n      console.log(\"It is test for lambda action of AWS IoT Rule.\", event);\n    };"))
        .build();

TopicRule.Builder.create(this, "TopicRule")
        .topicRuleName("MyTopicRule") // optional
        .description("invokes the lambda function") // optional
        .sql(IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"))
        .actions(List.of(new LambdaFunctionAction(func)))
        .build();

csharp

var func = new Function(this, "MyFunction", new FunctionProps {
    Runtime = Runtime.NODEJS_LATEST,
    Handler = "index.handler",
    Code = Code.FromInline(@"
        exports.handler = (event) => {
          console.log(""It is test for lambda action of AWS IoT Rule."", event);
        };")
});

new TopicRule(this, "TopicRule", new TopicRuleProps {
    TopicRuleName = "MyTopicRule",  // optional
    Description = "invokes the lambda function",  // optional
    Sql = IotSql.FromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
    Actions = new [] { new LambdaFunctionAction(func) }
});

func := lambda.NewFunction(this, jsii.String("MyFunction"), &FunctionProps{
	Runtime: lambda.Runtime_NODEJS_LATEST(),
	Handler: jsii.String("index.handler"),
	Code: lambda.Code_FromInline(jsii.String(`
	    exports.handler = (event) => {
	      console.log("It is test for lambda action of AWS IoT Rule.", event);
	    };`)),
})

iot.NewTopicRule(this, jsii.String("TopicRule"), &TopicRuleProps{
	TopicRuleName: jsii.String("MyTopicRule"),
	 // optional
	Description: jsii.String("invokes the lambda function"),
	 // optional
	Sql: iot.IotSql_FromStringAsVer20160323(jsii.String("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'")),
	Actions: []IAction{
		actions.NewLambdaFunctionAction(func),
	},
})

Or, you can add an action after constructing the TopicRule instance as following:

declare const func: lambda.Function;

const topicRule = new iot.TopicRule(this, 'TopicRule', {
  sql: iot.IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
});
topicRule.addAction(new actions.LambdaFunctionAction(func));

python

# func: lambda.Function


topic_rule = iot.TopicRule(self, "TopicRule",
    sql=iot.IotSql.from_string_as_ver20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'")
)
topic_rule.add_action(actions.LambdaFunctionAction(func))

java

Function func;


TopicRule topicRule = TopicRule.Builder.create(this, "TopicRule")
        .sql(IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"))
        .build();
topicRule.addAction(new LambdaFunctionAction(func));

csharp

Function func;


var topicRule = new TopicRule(this, "TopicRule", new TopicRuleProps {
    Sql = IotSql.FromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'")
});
topicRule.AddAction(new LambdaFunctionAction(func));

var func Function


topicRule := iot.NewTopicRule(this, jsii.String("TopicRule"), &TopicRuleProps{
	Sql: iot.IotSql_FromStringAsVer20160323(jsii.String("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'")),
})
topicRule.AddAction(actions.NewLambdaFunctionAction(func))

You can also supply errorAction as following, and the IoT Rule will trigger it if a rule's action is unable to perform:

import * as logs from 'aws-cdk-lib/aws-logs';

const logGroup = new logs.LogGroup(this, 'MyLogGroup');

new iot.TopicRule(this, 'TopicRule', {
  sql: iot.IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
  errorAction: new actions.CloudWatchLogsAction(logGroup),
});

python

import aws_cdk.aws_logs as logs


log_group = logs.LogGroup(self, "MyLogGroup")

iot.TopicRule(self, "TopicRule",
    sql=iot.IotSql.from_string_as_ver20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
    error_action=actions.CloudWatchLogsAction(log_group)
)

java

import software.amazon.awscdk.services.logs.*;


LogGroup logGroup = new LogGroup(this, "MyLogGroup");

TopicRule.Builder.create(this, "TopicRule")
        .sql(IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"))
        .errorAction(new CloudWatchLogsAction(logGroup))
        .build();

csharp

using Amazon.CDK.AWS.Logs;


var logGroup = new LogGroup(this, "MyLogGroup");

new TopicRule(this, "TopicRule", new TopicRuleProps {
    Sql = IotSql.FromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
    ErrorAction = new CloudWatchLogsAction(logGroup)
});

import logs "github.com/aws/aws-cdk-go/awscdk"


logGroup := logs.NewLogGroup(this, jsii.String("MyLogGroup"))

iot.NewTopicRule(this, jsii.String("TopicRule"), &TopicRuleProps{
	Sql: iot.IotSql_FromStringAsVer20160323(jsii.String("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'")),
	ErrorAction: actions.NewCloudWatchLogsAction(logGroup),
})

If you wanna make the topic rule disable, add property enabled: false as following:

new iot.TopicRule(this, 'TopicRule', {
  sql: iot.IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
  enabled: false,
});

python

iot.TopicRule(self, "TopicRule",
    sql=iot.IotSql.from_string_as_ver20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
    enabled=False
)

java

TopicRule.Builder.create(this, "TopicRule")
        .sql(IotSql.fromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"))
        .enabled(false)
        .build();

csharp

new TopicRule(this, "TopicRule", new TopicRuleProps {
    Sql = IotSql.FromStringAsVer20160323("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'"),
    Enabled = false
});

iot.NewTopicRule(this, jsii.String("TopicRule"), &TopicRuleProps{
	Sql: iot.IotSql_FromStringAsVer20160323(jsii.String("SELECT topic(2) as device_id, timestamp() as timestamp FROM 'device/+/data'")),
	Enabled: jsii.Boolean(false),
})

See also @aws-cdk/aws-iot-actions-alpha for other actions.

Logging

AWS IoT provides a logging feature that allows you to monitor and log AWS IoT activity.

You can enable IoT logging with the following code:

new iot.Logging(this, 'Logging', {
  logLevel: iot.LogLevel.INFO,
});

python

iot.Logging(self, "Logging",
    log_level=iot.LogLevel.INFO
)

java

Logging.Builder.create(this, "Logging")
        .logLevel(LogLevel.INFO)
        .build();

csharp

new Logging(this, "Logging", new LoggingProps {
    LogLevel = LogLevel.INFO
});

iot.NewLogging(this, jsii.String("Logging"), &LoggingProps{
	LogLevel: iot.LogLevel_INFO,
})

Note: All logs are forwarded to the AWSIotLogsV2 log group in CloudWatch.

Audit

An AWS IoT Device Defender audit looks at account- and device-related settings and policies to ensure security measures are in place. An audit can help you detect any drifts from security best practices or access policies.

Account Audit Configuration

The IoT audit includes various audit checks, and it is necessary to configure settings to enable those checks.

You can enable an account audit configuration with the following code:

// Audit notification are sent to the SNS topic
declare const targetTopic: sns.ITopic;

new iot.AccountAuditConfiguration(this, 'AuditConfiguration', {
  targetTopic,
});

python

# Audit notification are sent to the SNS topic
# target_topic: sns.ITopic


iot.AccountAuditConfiguration(self, "AuditConfiguration",
    target_topic=target_topic
)

java

// Audit notification are sent to the SNS topic
ITopic targetTopic;


AccountAuditConfiguration.Builder.create(this, "AuditConfiguration")
        .targetTopic(targetTopic)
        .build();

csharp

// Audit notification are sent to the SNS topic
ITopic targetTopic;


new AccountAuditConfiguration(this, "AuditConfiguration", new AccountAuditConfigurationProps {
    TargetTopic = targetTopic
});

// Audit notification are sent to the SNS topic
var targetTopic ITopic


iot.NewAccountAuditConfiguration(this, jsii.String("AuditConfiguration"), &AccountAuditConfigurationProps{
	TargetTopic: TargetTopic,
})

By default, all audit checks are enabled, but it is also possible to enable only specific audit checks.

new iot.AccountAuditConfiguration(this, 'AuditConfiguration', {
  checkConfiguration: {
    // enabled
    authenticatedCognitoRoleOverlyPermissiveCheck: true,
    // enabled by default
    caCertificateExpiringCheck: undefined,
    // disabled
    caCertificateKeyQualityCheck: false,
    conflictingClientIdsCheck: false,
    deviceCertificateAgeCheck: false,
    deviceCertificateExpiringCheck: false,
    deviceCertificateKeyQualityCheck: false,
    deviceCertificateSharedCheck: false,
    intermediateCaRevokedForActiveDeviceCertificatesCheck: false,
    ioTPolicyPotentialMisConfigurationCheck: false,
    iotPolicyOverlyPermissiveCheck: false,
    iotRoleAliasAllowsAccessToUnusedServicesCheck: false,
    iotRoleAliasOverlyPermissiveCheck: false,
    loggingDisabledCheck: false,
    revokedCaCertificateStillActiveCheck: false,
    revokedDeviceCertificateStillActiveCheck: false,
    unauthenticatedCognitoRoleOverlyPermissiveCheck: false,
  },
});

python

iot.AccountAuditConfiguration(self, "AuditConfiguration",
    check_configuration=iot.CheckConfiguration(
        # enabled
        authenticated_cognito_role_overly_permissive_check=True,
        # enabled by default
        ca_certificate_expiring_check=undefined,
        # disabled
        ca_certificate_key_quality_check=False,
        conflicting_client_ids_check=False,
        device_certificate_age_check=False,
        device_certificate_expiring_check=False,
        device_certificate_key_quality_check=False,
        device_certificate_shared_check=False,
        intermediate_ca_revoked_for_active_device_certificates_check=False,
        io_t_policy_potential_mis_configuration_check=False,
        iot_policy_overly_permissive_check=False,
        iot_role_alias_allows_access_to_unused_services_check=False,
        iot_role_alias_overly_permissive_check=False,
        logging_disabled_check=False,
        revoked_ca_certificate_still_active_check=False,
        revoked_device_certificate_still_active_check=False,
        unauthenticated_cognito_role_overly_permissive_check=False
    )
)

java

AccountAuditConfiguration.Builder.create(this, "AuditConfiguration")
        .checkConfiguration(CheckConfiguration.builder()
                // enabled
                .authenticatedCognitoRoleOverlyPermissiveCheck(true)
                // enabled by default
                .caCertificateExpiringCheck(undefined)
                // disabled
                .caCertificateKeyQualityCheck(false)
                .conflictingClientIdsCheck(false)
                .deviceCertificateAgeCheck(false)
                .deviceCertificateExpiringCheck(false)
                .deviceCertificateKeyQualityCheck(false)
                .deviceCertificateSharedCheck(false)
                .intermediateCaRevokedForActiveDeviceCertificatesCheck(false)
                .ioTPolicyPotentialMisConfigurationCheck(false)
                .iotPolicyOverlyPermissiveCheck(false)
                .iotRoleAliasAllowsAccessToUnusedServicesCheck(false)
                .iotRoleAliasOverlyPermissiveCheck(false)
                .loggingDisabledCheck(false)
                .revokedCaCertificateStillActiveCheck(false)
                .revokedDeviceCertificateStillActiveCheck(false)
                .unauthenticatedCognitoRoleOverlyPermissiveCheck(false)
                .build())
        .build();

csharp

new AccountAuditConfiguration(this, "AuditConfiguration", new AccountAuditConfigurationProps {
    CheckConfiguration = new CheckConfiguration {
        // enabled
        AuthenticatedCognitoRoleOverlyPermissiveCheck = true,
        // enabled by default
        CaCertificateExpiringCheck = undefined,
        // disabled
        CaCertificateKeyQualityCheck = false,
        ConflictingClientIdsCheck = false,
        DeviceCertificateAgeCheck = false,
        DeviceCertificateExpiringCheck = false,
        DeviceCertificateKeyQualityCheck = false,
        DeviceCertificateSharedCheck = false,
        IntermediateCaRevokedForActiveDeviceCertificatesCheck = false,
        IoTPolicyPotentialMisConfigurationCheck = false,
        IotPolicyOverlyPermissiveCheck = false,
        IotRoleAliasAllowsAccessToUnusedServicesCheck = false,
        IotRoleAliasOverlyPermissiveCheck = false,
        LoggingDisabledCheck = false,
        RevokedCaCertificateStillActiveCheck = false,
        RevokedDeviceCertificateStillActiveCheck = false,
        UnauthenticatedCognitoRoleOverlyPermissiveCheck = false
    }
});

iot.NewAccountAuditConfiguration(this, jsii.String("AuditConfiguration"), &AccountAuditConfigurationProps{
	CheckConfiguration: &CheckConfiguration{
		// enabled
		AuthenticatedCognitoRoleOverlyPermissiveCheck: jsii.Boolean(true),
		// enabled by default
		CaCertificateExpiringCheck: undefined,
		// disabled
		CaCertificateKeyQualityCheck: jsii.Boolean(false),
		ConflictingClientIdsCheck: jsii.Boolean(false),
		DeviceCertificateAgeCheck: jsii.Boolean(false),
		DeviceCertificateExpiringCheck: jsii.Boolean(false),
		DeviceCertificateKeyQualityCheck: jsii.Boolean(false),
		DeviceCertificateSharedCheck: jsii.Boolean(false),
		IntermediateCaRevokedForActiveDeviceCertificatesCheck: jsii.Boolean(false),
		IoTPolicyPotentialMisConfigurationCheck: jsii.Boolean(false),
		IotPolicyOverlyPermissiveCheck: jsii.Boolean(false),
		IotRoleAliasAllowsAccessToUnusedServicesCheck: jsii.Boolean(false),
		IotRoleAliasOverlyPermissiveCheck: jsii.Boolean(false),
		LoggingDisabledCheck: jsii.Boolean(false),
		RevokedCaCertificateStillActiveCheck: jsii.Boolean(false),
		RevokedDeviceCertificateStillActiveCheck: jsii.Boolean(false),
		UnauthenticatedCognitoRoleOverlyPermissiveCheck: jsii.Boolean(false),
	},
})

To configure the device certificate age check, you can specify the duration for the check:

import { Duration } from 'aws-cdk-lib';

new iot.AccountAuditConfiguration(this, 'AuditConfiguration', {
  checkConfiguration: {
    deviceCertificateAgeCheck: true,
    // The default value is 365 days
    // Valid values range from 30 days (minimum) to 3650 days (10 years, maximum)
    deviceCertificateAgeCheckDuration: Duration.days(365),
  },
});

python

from aws_cdk import Duration


iot.AccountAuditConfiguration(self, "AuditConfiguration",
    check_configuration=iot.CheckConfiguration(
        device_certificate_age_check=True,
        # The default value is 365 days
        # Valid values range from 30 days (minimum) to 3650 days (10 years, maximum)
        device_certificate_age_check_duration=Duration.days(365)
    )
)

java

import software.amazon.awscdk.Duration;


AccountAuditConfiguration.Builder.create(this, "AuditConfiguration")
        .checkConfiguration(CheckConfiguration.builder()
                .deviceCertificateAgeCheck(true)
                // The default value is 365 days
                // Valid values range from 30 days (minimum) to 3650 days (10 years, maximum)
                .deviceCertificateAgeCheckDuration(Duration.days(365))
                .build())
        .build();

csharp

using Amazon.CDK;

new AccountAuditConfiguration(this, "AuditConfiguration", new AccountAuditConfigurationProps {
    CheckConfiguration = new CheckConfiguration {
        DeviceCertificateAgeCheck = true,
        // The default value is 365 days
        // Valid values range from 30 days (minimum) to 3650 days (10 years, maximum)
        DeviceCertificateAgeCheckDuration = Duration.Days(365)
    }
});

import "github.com/aws/aws-cdk-go/awscdk"


iot.NewAccountAuditConfiguration(this, jsii.String("AuditConfiguration"), &AccountAuditConfigurationProps{
	CheckConfiguration: &CheckConfiguration{
		DeviceCertificateAgeCheck: jsii.Boolean(true),
		// The default value is 365 days
		// Valid values range from 30 days (minimum) to 3650 days (10 years, maximum)
		DeviceCertificateAgeCheckDuration: awscdk.Duration_Days(jsii.Number(365)),
	},
})

Scheduled Audit

You can create a scheduled audit that is run at a specified time interval. Checks must be enabled for your account by creating AccountAuditConfiguration.

declare const config: iot.AccountAuditConfiguration;

// Daily audit
const dailyAudit = new iot.ScheduledAudit(this, 'DailyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.DAILY,
  auditChecks: [
    iot.AuditCheck.AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK,
  ],
})

// Weekly audit
const weeklyAudit = new iot.ScheduledAudit(this, 'WeeklyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.WEEKLY,
  dayOfWeek: iot.DayOfWeek.SUNDAY,
  auditChecks: [
    iot.AuditCheck.CA_CERTIFICATE_EXPIRING_CHECK,
  ],
});

// Monthly audit
const monthlyAudit = new iot.ScheduledAudit(this, 'MonthlyAudit', {
  accountAuditConfiguration: config,
  frequency: iot.Frequency.MONTHLY,
  dayOfMonth: iot.DayOfMonth.of(1),
  auditChecks: [
    iot.AuditCheck.CA_CERTIFICATE_KEY_QUALITY_CHECK,
  ],
});

python

# config: iot.AccountAuditConfiguration


# Daily audit
daily_audit = iot.ScheduledAudit(self, "DailyAudit",
    account_audit_configuration=config,
    frequency=iot.Frequency.DAILY,
    audit_checks=[iot.AuditCheck.AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK
    ]
)

# Weekly audit
weekly_audit = iot.ScheduledAudit(self, "WeeklyAudit",
    account_audit_configuration=config,
    frequency=iot.Frequency.WEEKLY,
    day_of_week=iot.DayOfWeek.SUNDAY,
    audit_checks=[iot.AuditCheck.CA_CERTIFICATE_EXPIRING_CHECK
    ]
)

# Monthly audit
monthly_audit = iot.ScheduledAudit(self, "MonthlyAudit",
    account_audit_configuration=config,
    frequency=iot.Frequency.MONTHLY,
    day_of_month=iot.DayOfMonth.of(1),
    audit_checks=[iot.AuditCheck.CA_CERTIFICATE_KEY_QUALITY_CHECK
    ]
)

java

AccountAuditConfiguration config;


// Daily audit
ScheduledAudit dailyAudit = ScheduledAudit.Builder.create(this, "DailyAudit")
        .accountAuditConfiguration(config)
        .frequency(Frequency.DAILY)
        .auditChecks(List.of(AuditCheck.AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK))
        .build();

// Weekly audit
ScheduledAudit weeklyAudit = ScheduledAudit.Builder.create(this, "WeeklyAudit")
        .accountAuditConfiguration(config)
        .frequency(Frequency.WEEKLY)
        .dayOfWeek(DayOfWeek.SUNDAY)
        .auditChecks(List.of(AuditCheck.CA_CERTIFICATE_EXPIRING_CHECK))
        .build();

// Monthly audit
ScheduledAudit monthlyAudit = ScheduledAudit.Builder.create(this, "MonthlyAudit")
        .accountAuditConfiguration(config)
        .frequency(Frequency.MONTHLY)
        .dayOfMonth(DayOfMonth.of(1))
        .auditChecks(List.of(AuditCheck.CA_CERTIFICATE_KEY_QUALITY_CHECK))
        .build();

csharp

AccountAuditConfiguration config;


// Daily audit
var dailyAudit = new ScheduledAudit(this, "DailyAudit", new ScheduledAuditProps {
    AccountAuditConfiguration = config,
    Frequency = Frequency.DAILY,
    AuditChecks = new [] { AuditCheck.AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK }
});

// Weekly audit
var weeklyAudit = new ScheduledAudit(this, "WeeklyAudit", new ScheduledAuditProps {
    AccountAuditConfiguration = config,
    Frequency = Frequency.WEEKLY,
    DayOfWeek = DayOfWeek.SUNDAY,
    AuditChecks = new [] { AuditCheck.CA_CERTIFICATE_EXPIRING_CHECK }
});

// Monthly audit
var monthlyAudit = new ScheduledAudit(this, "MonthlyAudit", new ScheduledAuditProps {
    AccountAuditConfiguration = config,
    Frequency = Frequency.MONTHLY,
    DayOfMonth = DayOfMonth.Of(1),
    AuditChecks = new [] { AuditCheck.CA_CERTIFICATE_KEY_QUALITY_CHECK }
});

var config AccountAuditConfiguration


// Daily audit
dailyAudit := iot.NewScheduledAudit(this, jsii.String("DailyAudit"), &ScheduledAuditProps{
	AccountAuditConfiguration: config,
	Frequency: iot.Frequency_DAILY,
	AuditChecks: []AuditCheck{
		iot.AuditCheck_AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK,
	},
})

// Weekly audit
weeklyAudit := iot.NewScheduledAudit(this, jsii.String("WeeklyAudit"), &ScheduledAuditProps{
	AccountAuditConfiguration: config,
	Frequency: iot.Frequency_WEEKLY,
	DayOfWeek: iot.DayOfWeek_SUNDAY,
	AuditChecks: []AuditCheck{
		iot.AuditCheck_CA_CERTIFICATE_EXPIRING_CHECK,
	},
})

// Monthly audit
monthlyAudit := iot.NewScheduledAudit(this, jsii.String("MonthlyAudit"), &ScheduledAuditProps{
	AccountAuditConfiguration: config,
	Frequency: iot.Frequency_MONTHLY,
	DayOfMonth: iot.DayOfMonth_Of(jsii.Number(1)),
	AuditChecks: []AuditCheck{
		iot.AuditCheck_CA_CERTIFICATE_KEY_QUALITY_CHECK,
	},
})

Types

Name	Kind	Summary
`AccountAuditConfiguration`	Construct (L2)	Defines AWS IoT Audit Configuration.
`Logging`	Construct (L2)	Defines AWS IoT Logging.
`ScheduledAudit`	Construct (L2)	Defines AWS IoT Scheduled Audit.
`TopicRule`	Construct (L2)	Defines an AWS IoT Rule in this stack.
`AccountAuditConfigurationProps`	Struct	Properties for defining AWS IoT Audit Configuration.
`ActionConfig`	Struct	Properties for an topic rule action.
`AuditCheck`	Enum	The AWS IoT Device Defender audit checks.
`CheckConfiguration`	Struct	The types of audit checks.
`DayOfMonth`	Class	The day of the month on which the scheduled audit takes place.
`DayOfWeek`	Enum	The day of the week on which the scheduled audit takes place.
`Frequency`	Enum	The frequency at which the scheduled audit takes place.
`IAccountAuditConfiguration`	Interface	Represents AWS IoT Audit Configuration.
`IAction`	Interface	An abstract action for TopicRule.
`ILogging`	Interface	Represents AWS IoT Logging.
`IotSql`	Class	Defines AWS IoT SQL.
`IotSqlConfig`	Struct	The type returned from the `bind()` method in `IotSql`.
`IScheduledAudit`	Interface	Represents AWS IoT Scheduled Audit.
`ITopicRule`	Interface	Represents an AWS IoT Rule.
`LoggingProps`	Struct	Properties for defining AWS IoT Logging.
`LogLevel`	Enum	The log level for the AWS IoT Logging.
`ScheduledAuditAttributes`	Struct	Construction properties for a Scheduled Audit.
`ScheduledAuditProps`	Struct	Properties for defining AWS IoT Scheduled Audit.
`TopicRuleProps`	Struct	Properties for defining an AWS IoT Rule.

AWS IoT Construct Library ​

TopicRule ​

Logging ​

Audit ​

Account Audit Configuration ​

Scheduled Audit ​

Types ​

AWS IoT Construct Library

`TopicRule`

Logging

Audit

Account Audit Configuration

Scheduled Audit

Types