如何把设备安全的接入AWS IoT（二）

IoTPolicyManagerArn=`aws iam create-policy \
--policy-name IoTPolicyManager \
--policy-document "{
    \"Version\": \"2012-10-17\",
    \"Statement\": [
        {
            \"Sid\": \"VisualEditor0\",
            \"Effect\": \"Allow\",
            \"Action\": \"iot:AttachPolicy\",
            \"Resource\": \"*\"
        }
    ]
}" | jq .Policy.Arn| sed 's/"//g'`

aws iam attach-role-policy --role-name IoTDeviceRoleInCognito \
--policy-arn ${IoTPolicyManagerArn}

cat <<EOF > ~/awsIoTAccessDemo/developer_provider.py
#!/usr/bin/env python
# -*- coding: utf-8 -*-

import boto3
import argparse
import json
from flask import Flask, abort, request, jsonify
#获取参数

parser = argparse.ArgumentParser(description='developer idp provider.')
parser.add_argument('--developer_provider_name', default='login.IoTDemo.dev',
            help='developer_provider_name')
parser.add_argument('--identityPoolId', required=True,
            help='identityPoolId')
parser.add_argument('--AccessKeyId', required=True,
            help='AccessKeyId')
parser.add_argument('--SecretAccessKey', required=True,
            help='SecretAccessKey')

args = parser.parse_args()
developer_provider_name = args.developer_provider_name
identityPoolId = args.identityPoolId
access_key_id = args.AccessKeyId
secret_access_key = args.SecretAccessKey

app = Flask(__name__)

region = 'cn-north-1'
tokenDuration = 3600

cognito_client = boto3.client('cognito-identity',region_name=region,aws_access_key_id=access_key_id,aws_secret_access_key=secret_access_key)
#cognito_client = boto3.client('cognito-identity',region_name=region)

@app.route('/login/', methods=['POST'])
def login():
    if not request.json or 'device_id' not in request.json:
        abort(400)

    device_id = request.json['device_id']

    try:
        response = cognito_client.get_open_id_token_for_developer_identity(IdentityPoolId=identityPoolId,Logins={developer_provider_name:device_id},TokenDuration=tokenDuration)
        token = response['Token']
        identityId = response['IdentityId']
        return jsonify({'result': 'success','identityId':identityId,'token':token})
    except Exception as e:
        return jsonify({'result': 'failed'})

if __name__ == "__main__":
# 将host设置为0.0.0.0，则外网用户也可以访问到这个服务

 app.run(host="0.0.0.0", port=8383, debug=True)
EOF

cat <<EOF > ~/awsIoTAccessDemo/device_cognito_http.py
#!/usr/bin/env python
# -*- coding: utf-8 -*-

import boto3
import argparse
import json
import requests
#获取参数

parser = argparse.ArgumentParser(description='Send data to IoT Core')
parser.add_argument('--data', default="data from device_cognito_http",
            help='data to IoT')
parser.add_argument('--iot_policy_name', default="IoTPolicyForDeviceCognitohttp",
            help='iot policy name for device cognito http.')
parser.add_argument('--developer_provicer_endpoint', default="http://127.0.0.1:8383/login/",
            help='developer ID provider endpoint')

args = parser.parse_args()
data = args.data
policy_name = args.iot_policy_name
developer_provicer_endpoint = args.developer_provicer_endpoint

device_name = 'device_cognito_http'
region = 'cn-north-1'
topic = "IoTDemo/"+device_name

headers = {"Content-Type": "application/json"}
body = {"device_id":device_name}
r1 = requests.post(developer_provicer_endpoint, data=json.dumps(body), headers = headers)

token = json.loads(r1.text)['token']
identityId = json.loads(r1.text)['identityId']

cognito_client = boto3.client('cognito-identity', region_name=region)
response = cognito_client.get_credentials_for_identity(IdentityId=identityId, Logins={'cognito-identity---cn-north-1.amazonaws.com.rproxy.goskope.com.cn':token})

sessionToken=response['Credentials']['SessionToken']
accessKeyId=response['Credentials']['AccessKeyId']
secretKey=response['Credentials']['SecretKey']

iot_client = boto3.client('iot',region_name=region,aws_access_key_id=accessKeyId,aws_secret_access_key=secretKey,aws_session_token=sessionToken)

response = iot_client.attach_policy(
    policyName=policy_name,
    target=identityId
)

iot_data_client = boto3.client('iot-data',region_name=region,aws_access_key_id=accessKeyId,aws_secret_access_key=secretKey,aws_session_token=sessionToken)

response = iot_data_client.publish(
    topic=topic,
    qos=0,
    payload=json.dumps({"source":device_name, "data":data})
)

EOF

cat <<EOF > ~/awsIoTAccessDemo/device_cognito_websocket.py
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from AWSIoTPythonSDK.MQTTLib import AWSIoTMQTTClient
import json
import time
import sys
import boto3
import requests
import argparse
#获取参数

parser = argparse.ArgumentParser(description='Send data to IoT Core')
parser.add_argument('--iot_policy_name', default="IoTPolicyForDeviceCognitoWebsocket",
            help='iot policy name for device_cognito_websocket.')
parser.add_argument('--developer_provicer_endpoint', default="http://127.0.0.1:8383/login/",
            help='developer ID provider endpoint')
parser.add_argument('--endpoint_prefix', required=True,
            help='your iot endpoint prefix.')

args = parser.parse_args()
policy_name = args.iot_policy_name
developer_provicer_endpoint = args.developer_provicer_endpoint
endpoint_prefix = args.endpoint_prefix
device_name = 'device_cognito_websocket'
region = 'cn-north-1'
private_topic = "IoTDemo/"+device_name
server_root_ca_file = "./AmazonRootCA1.pem"
endpoint = "%s---ats---iot---cn-north-1.amazonaws.com.rproxy.goskope.com.cn" % endpoint_prefix
port = 443

headers = {"Content-Type": "application/json"}
body = {"device_id":device_name}
r1 = requests.post(developer_provicer_endpoint, data=json.dumps(body), headers = headers)
token = json.loads(r1.text)['token']
identityId = json.loads(r1.text)['identityId']
cognito_client = boto3.client('cognito-identity', region_name=region)
response = cognito_client.get_credentials_for_identity(IdentityId=identityId, Logins={'cognito-identity---cn-north-1.amazonaws.com.rproxy.goskope.com.cn':token})
sessionToken=response['Credentials']['SessionToken']
accessKeyId=response['Credentials']['AccessKeyId']
secretKey=response['Credentials']['SecretKey']
iot_client = boto3.client('iot',region_name=region,aws_access_key_id=accessKeyId,aws_secret_access_key=secretKey,aws_session_token=sessionToken)
response = iot_client.attach_policy(
    policyName=policy_name,
    target=identityId
)

# Custom MQTT message callback
def customCallback(client, userdata, message):
    print("Received a new message: ")
    print(message.payload)
    print("from topic: ")
    print(message.topic)
    print("--------------\n\n")

def pub_msg():
    try:
        pri_loopCount = 0
        while True:
            print 'please input:',
            msg = raw_input()
            private_data = msg
            message = {}
            message['message'] = json.dumps({"source":device_name, "data":private_data})
            message['sequence'] = pri_loopCount
            messageJson = json.dumps(message)
            myAWSIoTMQTTClient.publish(private_topic, messageJson, 1)
            pri_loopCount += 1
            time.sleep(2)
    except:
        sys.exit()

if __name__ == '__main__':
    # Init AWSIoTMQTTClient
    myAWSIoTMQTTClient = None
    myAWSIoTMQTTClient = AWSIoTMQTTClient(device_name, useWebsocket=True)
    myAWSIoTMQTTClient.configureEndpoint(endpoint, port)
    myAWSIoTMQTTClient.configureCredentials(server_root_ca_file)
    myAWSIoTMQTTClient.configureIAMCredentials(accessKeyId, secretKey, sessionToken)

    # AWSIoTMQTTClient connection configuration
    myAWSIoTMQTTClient.configureAutoReconnectBackoffTime(1, 32, 20)
    myAWSIoTMQTTClient.configureOfflinePublishQueueing(-1)  # Infinite offline Publish queueing
    myAWSIoTMQTTClient.configureDrainingFrequency(2)  # Draining: 2 Hz
    myAWSIoTMQTTClient.configureConnectDisconnectTimeout(10)  # 10 sec
    myAWSIoTMQTTClient.configureMQTTOperationTimeout(5)  # 5 sec

    # Connect and subscribe to AWS IoT
    myAWSIoTMQTTClient.connect()
    myAWSIoTMQTTClient.subscribe(private_topic, 1, customCallback)
    time.sleep(2)

    pub_msg()
EOF