AWS IoT Core (MQTT Broker) Integration Guide

New
  • Published on Nov 14, 2025
  • 4 minute(s) read
  • TL
 Prev Next

Tulip Interface to AWS IoT Core Integration - AWS Console Guide

Overview

This guide shows how to connect your Tulip Interface to AWS IoT Core using only the AWS Console - no command line required!

Prerequisites

  • AWS Console access with IoT permissions
  • Access to Tulip Interface with MQTT connector capability
  • Web browser

Step 1: Create IoT Thing

1.1 Navigate to AWS IoT Console

  1. Go to AWS IoT Console
  2. In the left sidebar, click Manage → Things

1.2 Create New Thing

  1. Click Create things
  2. Select Create single thing
  3. Click Next
  4. Enter Thing name: tulip-interface-client
  5. Leave other fields as default
  6. Click Next

Step 2: Create Device Certificate

2.1 Certificate Configuration

  1. Select Auto-generate a new certificate
  2. Click Next

2.2 Create IoT Policy

  1. Click Create policy
  2. In the new tab that opens:
  3. Policy name: TulipMQTTPolicy
  4. Policy document: Click JSON tab and paste: json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:*" ], "Resource": "*" } ] }
  5. Click Create
  6. Return to the previous tab

2.3 Attach Policy

  1. Refresh the policy list
  2. Select TulipMQTTPolicy
  3. Click Create thing

Step 3: Download Certificate Files

3.1 Download Required Files

IMPORTANT: Download these files immediately (you can't download them later):

  1. Device certificate → Save as certificate.pem.crt
  2. Private key file → Save as private.pem.key
  3. Amazon Root CA 1 → Save as AmazonRootCA1.pem
  4. Click Done

3.2 Create Certificate Chain File

  1. Open certificate.pem.crt in a text editor
  2. Open AmazonRootCA1.pem in a text editor
  3. Create a new file called cert_chain.pem
  4. Copy the entire contents of certificate.pem.crt into cert_chain.pem
  5. Add a new line at the end
  6. Copy the entire contents of AmazonRootCA1.pem and append to cert_chain.pem
  7. Save cert_chain.pem

Step 4: Convert Private Key Format

4.1 Online Conversion Tool

Since we're avoiding command line, use an online tool:

  1. Go to SSL Converter or similar tool
  2. Select Convert from: RSA Private Key
  3. Select Convert to: PKCS#8
  4. Upload your private.pem.key file
  5. Download the converted file as private_pkcs8.pem
Security Note: For production, use offline tools or command line for better security.

Step 5: Get IoT Endpoint

5.1 Find Your Endpoint

  1. In AWS IoT Console, go to Settings (left sidebar)
  2. Under Device data endpoint, copy the endpoint URL
  3. It looks like: a1234567890123-ats.iot.us-west-1.amazonaws.com
  4. Save this URL - you'll need it for Tulip configuration

Step 6: Configure Tulip Interface MQTT Connector

6.1 MQTT Connection Settings

In your Tulip Interface MQTT connector, configure:

  • MQTT Broker Host: [Your endpoint from Step 5]
  • Port: 8883
  • Protocol: MQTT over TLS or MQTTS
  • Client ID: tulip-interface-client

6.2 Certificate Configuration

Upload these files to Tulip Interface:

  1. Certificate File: Upload cert_chain.pem
  2. Private Key File: Upload private_pkcs8.pem
  3. CA Certificate File: Upload AmazonRootCA1.pem

6.3 Topic Configuration

  • Publish Topic: tulip/data
  • Subscribe Topic: tulip/commands (optional)

Step 7: Enable CloudWatch Logging (Optional)

7.1 Create IAM Role

  1. Go to IAM Console
  2. Click Roles → Create role
  3. Select AWS service → IoT
  4. Click Next
  5. Search and select CloudWatchLogsFullAccess
  6. Click Next
  7. Role name: IoTLogsRole
  8. Click Create role

7.2 Enable IoT Logging

  1. Return to AWS IoT Console
  2. Go to Settings (left sidebar)
  3. Under Logs, click Edit
  4. Level of verbosity: Info
  5. Set role: Select IoTLogsRole
  6. Click Update

Step 8: Test Connection

8.1 Monitor in AWS Console

  1. Go to Test → MQTT test client
  2. Click Subscribe to a topic
  3. Topic filter: tulip/data
  4. Click Subscribe

8.2 Test from Tulip

  1. Send a test message from Tulip Interface
  2. You should see the message appear in the AWS MQTT test client

8.3 Check CloudWatch Logs (if enabled)

  1. Go to CloudWatch Console
  2. Click Logs → Log groups
  3. Find AWSIotLogsV2
  4. Click on the log group to view connection logs

Troubleshooting

Common Issues and Console Solutions

1. Certificate Not Working

Problem: Connection fails with certificate errors Solution: - Ensure you're using cert_chain.pem (not individual certificate) - Verify private key is in PKCS#8 format (private_pkcs8.pem)

2. Policy Issues

Problem: Authorization failures in logs Solution: 1. Go to Secure → Policies 2. Click on TulipMQTTPolicy 3. Verify the JSON policy allows "iot:*" on "*" resources

3. Wrong Endpoint

Problem: Cannot connect to broker Solution: 1. Go to Settings in IoT Console 2. Copy the exact endpoint URL (including -ats suffix) 3. Use port 8883

4. Certificate Not Attached

Problem: Authentication failures Solution: 1. Go to Secure → Certificates 2. Click on your certificate 3. Check Things and Policies tabs 4. Ensure tulip-interface-client thing and TulipMQTTPolicy are attached

File Summary

You should have these files for Tulip configuration:

📁 Downloaded Files
├── certificate.pem.crt      # Original device certificate
├── private.pem.key          # Original private key
├── AmazonRootCA1.pem        # Amazon Root CA
├── cert_chain.pem           # Certificate + Root CA ← Use this
└── private_pkcs8.pem        # Converted private key ← Use this

Quick Reference Card

Tulip MQTT Configuration Summary

Setting Value
Host [your-endpoint]-ats.iot.[region].amazonaws.com
Port 8883
Client ID tulip-interface-client
Topic tulip/data
Certificate cert_chain.pem
Private Key private_pkcs8.pem
CA Certificate AmazonRootCA1.pem

AWS Console Quick Links

Success Indicators

✅ Connection Successful

  • Tulip Interface shows "Connected" status
  • Messages appear in AWS MQTT test client when subscribed to tulip/data
  • CloudWatch logs show successful Publish-In events

❌ Connection Failed

  • Check certificate files are correct format
  • Verify endpoint URL is exact match from AWS Console
  • Ensure port 8883 is used
  • Confirm client ID matches thing name exactly

Security Best Practices

  1. Certificate Storage: Store certificate files securely in Tulip
  2. Policy Refinement: After testing, create more restrictive policies
  3. Monitoring: Enable CloudWatch logging for production monitoring
  4. Regular Rotation: Plan for certificate rotation (certificates expire in 2049)

Support Resources

  • AWS IoT Documentation: docs.aws.amazon.com/iot
  • Tulip Support: Contact Tulip support for MQTT connector issues
  • AWS Support: Use AWS Support for IoT Core issues
Note: This guide uses the AWS Console exclusively. For automation or scripting, refer to the CLI-based guide.