AWS IoT Device Management Secure Tunneling now supports single-use token and token rotation capabilities, making remote connections more secure
AWS IoT Secure Tunneling allows customers to access devices that are deployed behind restricted firewalls at remote sites. When a tunnel is created, a pair of client access tokens (CAT) will be generated and used by the source and destination devices to connect to the Secure Tunneling service. Prior to today, a token can be stored and reused, making it susceptible to malicious use. Now single-use tokens will be revoked after a successful connection. When the connection drops, instead of saving CATs to a local device and establishing a token re-delivery method, customers can call the RotateTunnelAccessToken API to deliver a new pair of CATs to the source and destination devices to resume connection with the original device in the predefined tunnel period. Once reconnected, customers can securely access and continue troubleshooting remote devices using Secure Tunneling.
AWS IoT Secure Tunneling allows customers to access devices that are deployed behind restricted firewalls at remote sites. When a tunnel is created, a pair of client access tokens (CAT) will be generated and used by the source and destination devices to connect to the Secure Tunneling service. Prior to today, a token can be stored and reused, making it susceptible to malicious use. Now single-use tokens will be revoked after a successful connection. When the connection drops, instead of saving CATs to a local device and establishing a token re-delivery method, customers can call the RotateTunnelAccessToken API to deliver a new pair of CATs to the source and destination devices to resume connection with the original device in the predefined tunnel period. Once reconnected, customers can securely access and continue troubleshooting remote devices using Secure Tunneling.
IoT Developers and Fleet Administrators can use AWS Command Line Interface to call the RotateTunnelAccessToken API to regain access. There are no device-side actions required to use this feature. Depending on where the customer runs into connection issues, token rotation supports rotating CATs in source, destination, or both modes. Additionally, the new CATs will be published to destination devices via their subscribed MQTT topic to further reduce friction. This feature allows customers to access the same destination device multiple times before the tunnel duration exhausts.
Single-use token and token rotation are available in all AWS Regions where AWS IoT Device Management is available. Using the RotateTunnelAccessToken API is free of charge, but you will continue to incur costs for opening tunnels as specified on our pricing page. To get started with creating a tunnel, visit the AWS IoT Console or use the AWS CLI. To learn more about the single-use token and token rotation, read the RotateTunnelAccessToken API documentation and AWS IoT Device Management Secure Tunneling documentation.