This session will cover common customer implementations and patterns for building connected/smart home implementations with AWS IoT. This includes the end-user experience for onboarding a smart home appliance and then integrating it with the AWS ecosystem (for targeted push notifications, predictive maintenance, and so on). iRobot will join us to discuss their smart home integrations with the Roomba 980 and AWS IoT.

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
November 30, 2016
IoT401
Serverless IoT Back Ends
Olawale Oladehin, AWS Solutions Architect
Ben Kehoe, iRobot Cloud Robotics Research Scientist

2. The Things in the Internet of Things…

3. AWS re:Invent 2016
Olawale “Wale” Oladehin
• Amazon Web Services
Solutions Architect
@oladehin

4. Assuming you’ve heard of…
AWS
Lambda
Amazon
DynamoDB
AWS IoT
IoT
shadow
AWS IoT
rule
Amazon
SNS
Amazon
API
Gateway
Amazon
SQS
Amazon
Kinesis
Amazon
Elasticsearch
Service

5. What will you learn in this session
• Benefits of serverless IoT back ends
• Foundations of serverless IoT back ends
• iRobot customer experience

6. Advantages of
serverless IoT back ends

7. What are the principles of an IoT architecture?
Fault-tolerant
Decoupled Scalable
Cost-efficient
Visibility
Agility
Secure
Microservices
Distributed
Anti-fragile
DevOps
Low latency
Event sourcing

8. Advantages of serverless IoT back ends
Scalable Event-drivenDon’t pay for
idle
Stateless

9. Blueprint for serverless IoT
back ends

10. Blueprint for serverless IoT back ends
AWS LambdaAWS IoT Amazon API
Gateway

11. Blueprint for serverless IoT back ends
State management
Amazon
DynamoDB
Amazon
ElastiCache
Amazon
Elasticsearch
Service
AWS IoT
IoT
shadow
Amazon API
Gateway
AWS Lambda

12. Blueprint for serverless IoT back ends
Fast pipeline
AWS IoT Amazon API
Gateway
AWS Lambda
Amazon
S3
Amazon
Kinesis
Amazon
SQS
Amazon
SNS

13. Blueprint for serverless IoT back ends
Operations
Amazon
CloudWatch
AWS
CloudFormation
AWS IoT Amazon API
Gateway
AWS Lambda

14. Blueprint for serverless IoT back ends
State management Operations
Amazon
S3
Amazon
DynamoDB
Amazon
ElastiCache Amazon
CloudWatch
AWS
CloudFormation
Amazon
Elasticsearch
Service
Amazon
Kinesis
AWS IoT
IoT
shadow
Amazon
SQS
Amazon API
Gateway
Amazon
SNS
AWS Lambda
Fast pipeline

15. Example architecture for
serverless IoT back end

16. Example: smart transportation
Mobile device
Turnstiles

17. State management
State management Operations
Amazon
S3
Amazon
DynamoDB
Amazon
ElastiCache Amazon
CloudWatch
AWS
CloudFormation
Amazon
Elasticsearch
Service
Amazon
Kinesis
IoT
shadow
Amazon
SQS
Amazon
SNS
Fast pipeline

18. Stateless != state doesn’t matter
• How do we deal with state?
• Store output
• Search index
• Time series
• Structured

19. Stateless != state doesn’t matter
• How do we deal with state?
• Store output
• Store each event
• Analytics
• True system
history
• Arbitrary
projections
(x)

20. Smart transportation – mobile device
Topic:
$aws/events/subscriptions/subscribed/*
API Gateway Lambda Sign up
Events
Lambda AWS IoT
Republish rule
Fault-tolerant
Cost-efficient
Scalable
Agile
Secure
Visibility
IoT
shadow
Offline SNS
Registration
Lambda

21. Smart transportation – shadow republish
{
"sql": "SELECT topics as state.reported.stations
FROM '$aws/events/subscriptions/subscribed/#'"
WHERE eventType = 'subscribed',
"actions": [{
"republish": {
"topic":"$$aws/things/${topic(5)}/shadow/update",
"roleArn":"arn:aws:iam::123456789:role/republish"
}
}]
}

22. Fast pipeline
State management Fast pipeline Operations
Amazon
S3
Amazon
DynamoDB
Amazon
ElastiCache Amazon
CloudWatch
AWS
CloudFormation
Amazon
Elasticsearch
Service
Amazon
Kinesis
IoT
shadow
Amazon
SQS
Amazon
SNS

23. Fast pipeline - components
• AWS Lambda
• Internal
applications
• Amazon Kinesis
• Amazon SQS
• Amazon SNS
• Amazon S3
ConsumerPipeProducer
• AWS IoT rules
• AWS Lambda
• Amazon API
Gateway

24. When to use a fast pipeline
AWS IoT Republish
Rule
AWS Lambda IoT pipeline
Transactions per
second
Predictable or steady
volume
Infrequent or steady
volume
High or
unpredictable
volume
Communication
pattern
Request/ACK
Publish/Subscribe
Request/ACK
Request/Response
Request/ACK
Request/Response
Ingest
Deployment
pattern
Rule replacement Lambda alias Consumer
replacement
Transformations IoT data
Rules engine context
Contextual
transformation
Aggregations
Event-analysis

25. Smart transportation – pipeline
Time Series
Traffic
Commuter
Subway
Event
Amazon
Kinesis
Firehose
Time Series
Backup
Commuter
Online Status
Topic: LWT disconnects
Delay Connection
Events
Fault-Tolerant
Cost-efficient
Scalable
Agile
Secure
Visibility
Amazon
Kinesis
Streams
Poller / Worker
Functions
Topic:
train/<line>/station/<sid>
Topic: user/<id>/trip/<tid>

26. IoT operations
State management Fast pipeline Operations
Amazon
S3
Amazon
DynamoDB
Amazon
ElastiCache Amazon
CloudWatch
AWS
CloudFormation
Amazon
Elasticsearch
Service
Amazon
Kinesis
IoT
shadow
Amazon
SQS
Amazon
SNS

27. IoT operations
• Custom CloudWatch logs and metrics
• Shared library in AWS Lambda code
• Application metrics attached IoT rule
• Enable AWS IoT CloudWatch Logs
• Deployment
• Group functions into services
• Fault-tolerant
• Graceful degradation
• Trigger automatic failover
• Configure CloudWatch alarms

28. Smart transportation – metrics
Fault-tolerant
Cost-efficient
Scalable
Agile
Secure
Visibility
AlarmCloudWatch
Amazon
Kinesis
Lambda

29. Smart transportation – operations IoT rule
{
"sql": "SELECT *,newuuid() AS requestId, timestamp() AS
timestamp, topic(2) AS subwayId, topic(4) AS
stationId FROM 'train/+/station/+/v1' ",
"actions": [{
...
}]
}

30. Smart transportation – deployment
Service separation:
• Share data
• Interface API
Gateway
• Interface AWS
LambdaSubscription service
Tollgate service
Connections service

31. Blueprint for serverless IoT back ends
State management Operations
Amazon
S3
Amazon
DynamoDB
Amazon
ElastiCache Amazon
CloudWatch
AWS
CloudFormation
Amazon
Elasticsearch
Service
Amazon
Kinesis
AWS IoT
IoT
shadow
Amazon
SQS
Amazon API
Gateway
Amazon
SNS
AWS Lambda
Fast pipeline

32. AWS re:Invent 2016
Ben Kehoe
• iRobot Cloud Robotics
Research Scientist
@ben11kehoe

33. The
Consumer
Robot
Company

35. Just live your life - House does the right thing.
- Automatically configured and maintained.
- Adapts to your preferences.

36. Foundational Milestone
The Roomba 900 series provides
compelling user benefits today and is a
foundation for expanding the value of
robots in the home.
Key to this step is that Roomba is
connected and it systematically
navigates and maps the home.
In 10 months, we mapped more than 500
million square feet

37. IoT business
• User pays for device once
• Company pays cloud costs
for life of device
• Subscription models
• Result: without subscription,
minimize cloud cost

38. Choosing serverless at iRobot
• Experience building devices, not
cloud applications
• Fleet already at scale
• Go straight to serverless to skip
the undifferentiated heavy lifting
step

39. Serverless architecture @ iRobot

40. Login &
associate
Robot
registration
Firmware
update
Maintenance
data
Mapping
Robot
settings
Push
notifications
Mission
history
Robot
reset

41. Before serverless architecture
def foo(input):
quux = bar(input.baz)
internalState.quux = quux
def bar(input):
# do work
return result

42. Serverless architecture
def handler(event, context):
quux = Lambda.Invoke(
'bar',
event['baz'])
DynamoDB.PutItem(
'quux',
quux)
def handler(
event,
context):
# do work
return result
Foo
ExternalState
Bar

43. Serverless architecture
/register Check
cert
Robots to
register Queue
reader
Register
robot
Logging Lifecycle event
PermissionsCreate shadow
Dead letter queue

44. Serverless architecture
• Component graph = call graph
• Distributed system thinking:
• Traditionally occurs at system boundaries
• Serverless: must be treated
systematically
• Build robust-by-design systems

45. Architecture selection
Monolithic/layered Microservices

46. Microservices: interservice communication
Microservices

47. Robot history Permissions
Lambda LambdaAPI Gateway DynamoDB
KMS
Service interface: API Gateway backed by Lambda

48. https://www.prerender.cloud/lambda-latency

49. Robot history Permissions
Lambda LambdaAPI Gateway DynamoDB
KMS
Alternative: direct resource access through service
SDK

50. Microservices in code…

51. …but a monolith in deployment

52. Red/black deployment

53. Terminology (arbitrary)
Blue/green: update behind
the load balancer
Red/black: entirely
new copy

54. Red/black deployment options
Red/black an individual service?
Or the entire application?

55. Service discovery

56. Client discovery of endpoints
• How does a client
switch from one
endpoint to another?
Client ?
red.example.com
black.example.com

57. Client discovery of endpoints
• How does a client
switch from one
endpoint to another?
• DNS?
Client
Route53
red.example.com
black.example.com
prod.example.com
CNAME
red.example.com
CNAME
black.example.com

58. Client discovery of endpoints
• How does a client
switch from one
endpoint to another?
• DNS?
• Service discovery
service
• How do we
deploy this
service?
Client
red.example.com
black.example.com
HTTPS GET
svcdisc.example.com
{
"host":
"red.example.com"
}
{
"host":
"black.example.com"
}

59. Deployment for well-known endpoints
Client
red.svcdisc.example.com
black.svcdisc.example.com
HTTPS GET
svcdisc.example.com
CloudFront

60. Secure file transfer

61. Request topic
Presigned URL
Symmetric
encryption key
Robot
public key
Response topic
Presigned URL
Object encrypted with
symmetric key
HTTPS call
to presigned URL
S3
KMS
Robot
certificate
S3
bucket
+
symmetric key
encrypted with
robot public key

62. IoT security: certificates

63. Robot
certificate
+ signed timestamp
CA certificate
Unauthenticated
HTTPS
Robot
certificate
Authenticated
MQTT

64. Ops for AWS IoT:
account structure

65. Account structure
• Shadow and topics are not
namespaced
• If sharing accounts:
• Devs might step on
each other’s toes
• Harder to purge for
testing
• After ~10 accounts, adding
accounts gets amortized via
process

66. acct 1 acct 2 acct 3
us-east-1 NO NO
us-west-2 YES YES YES
eu-west-1 YES YES YES
Certificates, accounts, and regions
• Certificates in AWS IoT
must be unique in a region
even across accounts
• In another region, certificate
can exist in the same or
another account
• Certificates can be
transferred

67. Account structure
• Given constraints on
certificates, how do you
provision devices?
• Option 1: Separate CA(s)
for each dev accounts
• Option 2: Single Initial Point
of Contact account (prod or
other), push to other
accounts

68. Serverless Ops

69. Serverless ops
• Serverless is not NoOps
• Infrastructure as code
• Build artifacts
• Observability
• Logging
• Auditing
• Security
• Billing

70. Summary: iRobot’s cloud journey
• iRobot's place in the smart home
• Non-subscription cloud services
are cost-sensitive
• Skip heavy lifting with serverless
• Patterns:
• Direct resource access
• Full red/black deployments
• Service discovery service
with well-known endpoint
• CloudFront for deployment
• Enables AWS WAF
• Secure file transfer
• Account structure
• Serverless ops

71. Summary

72. Summary
• Goals of IoT architectures
• Benefits of serverless IoT back ends
• Blueprint for serverless IoT back ends
• State management
• Fast pipeline
• IoT operations

73. Thank you!

74. Remember to complete
your evaluations!

75. Related Sessions
• IoT403 Robots: The Fading Line Between Real and
Virtual Worlds
• SRV402 – Operating Your Production API
• SRV303 – Coca-Cola: Running Serverless Applications
with Enterprise Requirements