search

awslabs / aws-iot-certificate-vending-machine

The CVM allows a device to apply for its own certificate and installation.
Apache License 2.0
82 stars 16 forks source link

how to ensure one serialNumber only has one cert #7

Closed xwdreamer closed 5 years ago

xwdreamer commented 5 years ago

In index.js, you said should write the certificate ID/Arn to indicate that the device has applied for a certificate. And the user can not apply again. I do not understand this code, how to ensure one sn has one cert. Is it:

  1. DDB do not allow set certinfo the same value?

Looking forward to your reply.

image

cncoder commented 5 years ago

Sorry to reply late. After verifying the Token, you can check the corresponding certArn field based on seriaNumber. If the certArn field is not empty, the certificate is refused to be issued to the device. If the certArn field is empty, it proves that no certificate has been requested. Use this method to ensure that a seriaNumber has only one certificate.

xwdreamer commented 5 years ago

Hi, the lastest version have realize my requirement which ensure one serialNumber only has one Certificate. When one serialNumer apply one Certificate successfully, the next time I reqeust the same url, it will reply "null", same as this issure #6

My question is which function check the serialNumber has apply for one certificate. As I know:

  1. fucntion applycert focus on "create Apply cert & Attach thing, policy"
  2. function putCertinfo focus on "Put IoT cert info into Dynamodb"
eercanayar commented 5 years ago

There is no check for that. I've implemented that kind of checks by myself. By the way, we should discuss that should it response an error or the certs again? Maybe the device lost its certs and asking for them again.

I'll create a PR today for some checks, covers #6 and #7. Keep in mind that this lambda implementation isn't production-ready. There are lots of things to do and discuss for an healthy IoT device lifecycle.

xwdreamer commented 5 years ago

@eercanayar , so much agree with you. Maybe the device lost its cert or saved its cert failed, we should consider more abnormal scenarios. For the topic of healthy IoT device lifecycle, can you give some best practices?