Introducing the New Features of AWS Greengrass (IOT365) - AWS re:Invent 2018
•Descargar como PPTX, PDF•
0 recomendaciones•700 vistas
With AWS Greengrass, you can bring local compute, messaging, data caching, sync, and machine-learning inference capabilities to edge devices. Join us in this session to learn about new features that extend the capabilities of AWS Greengrass devices.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a Introducing the New Features of AWS Greengrass (IOT365) - AWS re:Invent 2018
Similar a Introducing the New Features of AWS Greengrass (IOT365) - AWS re:Invent 2018 (20)
Más de Amazon Web Services
Más de Amazon Web Services (20)
Introducing the New Features of AWS Greengrass (IOT365) - AWS re:Invent 2018
- 2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Introducing the New Features ofAWS IoTGreengrass Scott Allison Senior Product Manager Amazon Web Services 9 2 0 2 6 - I O T Dmitri Zimine Distinguished Engineer Extreme Networks James Floyd Sales Engineering Lead Logic Supply Tatiana Cooke Senior Product Manager Amazon Web Services
- 3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrass:WhyDidWe Build It? AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Common EdgeScenario Cache and analyze data Perform actions, transfer data to cloud services Collect data from on-premises devices AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrass releasev1.7 • Simplified deployments • AWS IoT Greengrass Connectors • Extreme Networks Demo • Enhanced security • AWS IoT Greengrass Secrets • AWS IoT Greengrass Hardware Security Integration • Logic Supply Demo • Greater flexibility • AWS IoT Greengrass per-Lambda Isolation and Permission Configurations AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility • ML Inference • More performant • Smaller footprint • Separate session to cover: <session ID>
- 7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrassConnectors Amazon Kinesis Data Firehose Amazon Simple Notification Service AWS IoT Device Defender Amazon CloudWatch Modbus RTU Protocol Adapter Raspberry Pi GPIO Serial Stream • More to come in 2019 • What are connectors? • Connectivity to AWS services, industrial protocols, local- and cloud-based applications • Code-free configuration and installation • 10 connectors available today AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrassConnectors AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility • How does it work? • Customers select and configure connectors via console or API/CLI • Attach to a AWS IoT Greengrass group and deploy
- 10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrassConnectors AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility • Connector Example:Amazon Simple Notification Service (Amazon SNS) • Create an Amazon SNS topic via the SNS console/API • Add Amazon SNS connector to AWS IoT Greengrass group via AWS IoT Greengrass console/API • Configure connector with ARN of SNS topic • Deploy • Publish messages to connector MQTT topic
- 11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrassConnectors AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility • Connector Example:Twilio • Add yourTwilio auth token to AWS Secrets Manager; select from connector config • Specify phone number and account SID • Deploy • Publish messages to connector MQTT topic
- 12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Dmitri Zimine Distinguished Engineer Extreme Networks
- 13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrassSecrets Manager • What is it? • Extends AWS Secrets Manager to the AWS IoT Greengrass cores for secure management of keys, passwords, credentials, endpoints, and configurations • Usable by connectors or AWS Lambda functions • Encrypted in transit and at rest AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrassSecrets Manager AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility • How does it work? • Customers provision secrets in AWS Secrets Manager • Attach a secret to a AWS IoT Greengrass group and deploy
- 16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrass HardwareSecurityIntegration AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility AWS IoT Greengrass Group AWS IoT Greengrass Core Device
- 17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrass HardwareSecurityIntegration AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility AWS CloudData AggregationVideo Cameras API Endpoint Database Application
- 18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrass HardwareSecurityIntegration AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility Private key stored in file system
- 19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrass HardwareSecurity Integration • How can I get started? 2. Update AWS IoT Greengrass configurations to point to that private key, rather than the file system private key 3. Provides ability to integrate with AWS IoT Greengrass Secrets 1. Follow vendor directions to generate a private key on your secure element AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrass HardwareSecurity Integration Partners AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. APN DQPSnapshot – pendingTBD / ifwecan https://devices.amazonaws.com/search?kw=AWS%20IoT%20Greengrass%20Hardware%20Security%20Integrati on&page=1
- 22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. James Floyd Sales Engineer Lead Logic Supply
- 23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Who Is Logic Supply? We are a global Industrial Computer Manufacturer specializing in small form factor, fanless hardware for IoT. ● Founded 2003 ● Headquartered in South Burlington, Vermont ● Other locations in The Netherlands and Taiwan ● 150 Employees ● 70,000 Customers ● ISO 9001 Manufacturing Facility
- 24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Our Computer Systems Our systems are designed to fit and survive in challenging environments ● Hardshell™ Fanless design ● Commercial through Rugged grade ● Embedded lifecycles ● Revision control
- 25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Logic Supply, AWS, and Our Clients Work Together Customer Cool Application
- 26. Greenkey in Building Automation
- 28. Greenkey in Building Automation
- 30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Isolationand PermissionConfigurations Customers want to test AWS IoT Greengrass in a diverse set of environments Run AWS IoT Greengrass with fewer dependencies and no kernel-level changes Access more local resources like Bluetooth Low Energy or USB devices Run AWS IoT Greengrass in a Docker container AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. EasiertoAddAWS IoTGreengrass toExisting ArchitecturethatUsesDockerContainers for Isolation Existing applications running in separate Docker containers Application A Run AWS IoT Greengrass in a Docker container Application B On-Premises Device
- 33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. NewModes Provide FlexibilityinConfiguringAWS IoT Greengrass • Today: AWS IoT Greengrass with per-Lambda container isolation • New: Run AWS IoT Greengrass as an OS process. AWS Lambda functions and AWS IoT Greengrass Group have no container • New: Hybrid mix of isolated Lambda functions and Lambda functions as OS processes AWS IoT Greengrass Core (1.7.0) with AWS IoT Greengrass Containers Device Resources accessed via Local Resource Access AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. NewModes Provide FlexibilityinConfiguringAWS IoT Greengrass • Today: AWS IoT Greengrass with per-Lambda container isolation • New: Run AWS IoT Greengrass as an OS process. AWS Lambda functions and AWS IoT Greengrass Group have no container • New: Hybrid mix of isolated Lambda functions and Lambda functions as OS processes AWS IoT Greengrass Core (1.7.0) with Greengrass Containers Device Resources accessed directly AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. NewModes Provide FlexibilityinConfiguringAWS IoT Greengrass • Today: AWS IoT Greengrass with per-Lambda container isolation • New: Run AWS IoT Greengrass as an OS process. AWS Lambda functions and AWS IoT Greengrass Group have no container • New: Hybrid mix of isolated Lambda functions and Lambda functions as OS processes AWS IoT Greengrass Core (1.7.0) with Greengrass Containers Device Resources accessed directly AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. NewAWS Per-Lambda Isolation and PermissionSettings AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. RunAWS IoTGreengrass inDocker on MacOSX or Windows 10 AWS IoT Greengrass Introduction Simplified Deployments Enhanced Security Greater Flexibility
- 38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS IoTGreengrass Releasev1.7 • Simplified deployments • AWS IoT Greengrass Connectors • Enhanced security • AWS IoT Greengrass Secrets • AWS IoT Greengrass Hardware Security Integration • Greater flexibility • AWS IoT Greengrass per-Lambda Isolation and Permission Configurations • Try it from the console • Connectors and documentation available now • Find qualified hardware • Follow this link for the AWS Partner Network Device Qualification Portal • Use our Docker file • Available XXXX
- 39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 40. Thank you! © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Scott Allison alliscot@amazon.com Tatiana Cooke tatcoo@amazon.com
- 41. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Notas del editor
- Write AWS Lambda functions, run at the edge Communicate securely with applications and services, locally and in the cloud Extend AWS services from to edge devices Run ML inference to make predictions based on local data Access local resources (cameras, file system, specialized hardware) on edge devices Perform actions, run analytics, cache data in intermittent connectivity scenarios
- Change to images; choose a few to highlight
- More visual; split into what is it & how does it work slides
- >AWS IoT Greengrass supports messaging both between the AWS IoT Cloud and the GGC, and between the GGC and other local devices through an MQTT server. >AWS IoT Greengrass uses X.509 certificates and AWS Identity and Access Management (IAM) roles to ensure that these communication channels are secure. >Core device certificates, core root CA certificates, and device certificates are all present to authenticate devices. There is a private key associated with each device certificate (one for the core device and one for the MQTT server certificate). For a message to be sent to the cloud, the AWS IoT Greengrass core uses its IoT cloud client certificate, the private key, and the root certificate authority to validate device identity during the TLS messaging handshake. This process verifies that both the IoT Cloud endpoint and AWS IoT Greengrass core device are who they say they are. A similar handshake occurs with local devices. After finding the IP address of the device with an AWS IoT Greengrass SDK, that device will pass its device certificate and client ID to the AWS IoT Greengrass core for validation before confirming the connection is valid. Today, we hear from many customers who have devices that are being used in unsecured real-world locations. For example, you might want to run Machine Learning on a video camera streaming information about customers waiting in line for a bus. You might want to put smart emergency responder equipment that tracks location in a vehicle. You might be interested in using temperature sensors to monitor energy use or equipment in an industrial equipment.
- PROBLEM / SOLUTION Today, we hear from many customers who have devices that are being used in unsecured real-world locations. For example, customers might want to process video and images of bus lines locally, then send the outcome of that analysis to a dashboard to monitor wait times at a large event. In this case, the AWS Protective Services team is using AWS IoT Greengrass cores on Logic Supply devices with Intel TPMs to aggregate video information is not physically secured and could be vulnerable to tampering or other security risks. Our new Hardware Security Integration features allows customers like this one [Amazon Device Security] to secure the private keys on the devices used for encryption in a tamper-proof physical hardware element.
- What is hardware security integration? AWS IoT Greengrass Core integrates with PKCS#11-compatible hardware secure elements for storing AWS IoT Greengrass core private keys PKCS#11 is a platform-independent API specification to interact with secure elements Secure element vendor configure PKCS#11 libraries to integrate with AWS IoT Greengrass Core
- If you’re a partner, we’re adding new tooling and qualification support for AWS IoT Greengrass and features like this one. You can see more about IoT device tester ????? [+screen shot if you can get it]
- Every day, we talk to clients who are tackling complex IoT challenges. They might have a unique software solution, or they might be an OEM building a device that requires reliable hardware, or they could be a large manufacturer trying to get their production equipment connected to the cloud. Increasingly, our clients are moving their applications to the cloud, with AWS as a key component of making their solution competitive and effective in their market. Factory Automation + ML600/ML500 (champlain cable?) Emergency Communications (Singlewire) Building Automation + CL200
- Image of "smart building" application. Ideally, we're able to illustrate data being sent from each of these applications, to the cloud. The idea being that each of these streams can be protected using Greenkey. As new devices are deployed, they're all authenticated using Greenkey to ensure authenticity. Each of these data streams, being sent to and acted on in the cloud have a hardware component gathering the data, a Logic Supply gateway device (pictures of a bunch of CL200s around the various places they might be used?) Each of these streams present a possible point of network vulnerability, so it's vital that they are all protected, using authentication provided by Greenkey.
- Image of "smart building" application. Ideally, we're able to illustrate data being sent from each of these applications, to the cloud. The idea being that each of these streams can be protected using Greenkey. As new devices are deployed, they're all authenticated using Greenkey to ensure authenticity. Each of these data streams, being sent to and acted on in the cloud have a hardware component gathering the data, a Logic Supply gateway device (pictures of a bunch of CL200s around the various places they might be used?) Each of these streams present a possible point of network vulnerability, so it's vital that they are all protected, using authentication provided by Greenkey.
- Today, AWS IoT Greengrass provides the benefits of isolation and security that come with running in a container environment.
- All AWS Lambda functions, including system AWS Lambda functions, are run outside of the AWS IoT Greengrass container environment. Can directly access local device resources. With non-containerized mode, you no longer need to make kernel-level changes to run AWS IoT Greengrass. AWS IoT Greengrass won’t have overlays or other container-level information. Note: At launch, it will not support ML inference or AWS IoT Greengrass connectors.
- Hybrid mode allows you to run specific AWS Lambda functions that need access to the underlying OS or hardware to run outside of containers.
- What is it? Customers can assign new UID and GID information at the level of AWS Lambda, giving them the option to assign new permissions to individual AWS Lambda functions How does it work? Customers will be able to make isolation changes at the group level, and both isolation and permission changes at the level of AWS Lambda from the AWS IoT Greengrass console