Provisioning AWS IoT Core for an STM32 Rust embedded telemetry node

In the previous post, the B-U585I-IOT02A development board published live sensor data to the public Mosquitto broker at test.mosquitto.org. The Rust firmware collected the following five groups of sensor readings:

• Temperature
• Humidity
• Atmospheric pressure
• Accelerometer readings
• Gyroscope readings

The firmware encoded the readings as JSON and published them over Wi-Fi using MQTT. An independent MQTT subscriber running on Ubuntu received and printed consecutive messages from the board.

The public broker provided a useful working baseline and confirmed the complete communication path from the STM32 sensors, through the Rust application and Wi-Fi module, to an external MQTT subscriber. The next step is to move the telemetry path to AWS IoT Core.

Why the existing MQTT connection cannot be reused unchanged

The working firmware connects to the public broker using plaintext MQTT on TCP port 1883. AWS IoT Core does not support unauthenticated plaintext MQTT connections.

For an MQTT connection authenticated with an X.509 client certificate, AWS IoT Core supports MQTT over TLS on TCP port 8883. AWS IoT Core also supports MQTT over TLS on port 443 when the client supplies the required ALPN protocol name, but port 8883 is the simpler starting point for this project.

To connect the STM32 to AWS IoT Core using MQTT over TLS, the connection requires:

• The account-specific AWS IoT data endpoint for the selected Region
• An X.509 device certificate
• The private key associated with that certificate
• An appropriate Amazon root CA certificate
• An AWS IoT policy that authorizes the required MQTT operations
• An MQTT client ID and topic that match the resources permitted by the policy
• TLS support in the STM32 network path

Keep the existing plaintext MQTT implementation as the known-working baseline while adding and verifying TLS support separately.

Preserving the verified source-code baseline

Before making any firmware changes, confirm that the previous work has been committed and pushed:

cd ~/stm32u5_iot_project
git status --short --branch
git branch --show-current
git log -5 --oneline --decorate
git tag --points-at HEAD

The output confirmed that the repository was clean and that main matched origin/main. The hardware-verified Wi-Fi and MQTT implementation had already been merged, and the Wi-Fi firmware-update package was present in the repository. Next, create a separate branch for the AWS IoT Core work:

git switch -c aws-iot-tls-bringup

Verify that the new branch is active and the working tree is clean:

## aws-iot-tls-bringup

This keeps the verified public-broker implementation available while the AWS connection is developed and tested.

Opening AWS IoT Core

Sign in to the AWS Management Console and select the Europe (London) Region:

eu-west-2

AWS IoT resources are regional, so create the Thing, certificate and policy in the intended Region and use the corresponding regional endpoint. Search for IoT Core in the AWS Management Console and open the service.

Opening the Things registry

From the AWS IoT Core navigation panel, open:

Manage → All devices → Things

AWS IoT Core uses a Thing as the registry-side representation of a physical or logical device. The Things page is empty when no devices have been registered.

Select Create things to begin registering the board.

Creating a single Thing

AWS provides options for creating either a single Thing or multiple Things. This project currently uses one STM32 board, so select Create single thing.

Enter the following Thing name:

stm32u5-vbhadra01

Use the same value as the MQTT client ID. This allows the connection policy to authorize one specific client ID. Leave the optional settings unchanged. A Device Shadow is not required for the current telemetry-publishing stage.

Thing names should be chosen carefully because AWS does not provide an operation for renaming an existing Thing. Changing the name requires creating another Thing and removing the old one.

Creating the device certificate

On the certificate configuration page, select:

Auto-generate a new certificate

The certificate provides the device identity used during mutual TLS authentication. The private key associated with the certificate must remain secret. The next page requires an AWS IoT policy. If no suitable policy exists, open the policy creation page before completing the Thing.

Creating a restricted publisher policy

Create the following policy:

stm32u5-telemetry-publisher-policy

Restrict the policy to:

• One MQTT client ID
• One telemetry topic
• The minimum operations currently required by the STM32 publisher

Use the following policy document:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "<CLIENT_RESOURCE_ARN>"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "<TOPIC_RESOURCE_ARN>"
    }
  ]
}

<AWS_ACCOUNT_ID> must be replaced with the AWS account ID in which the IoT resources are being created.

The two resource types in this policy are different:

client/stm32u5-vbhadra01

This is the MQTT client resource used by iot:Connect.

topic/stm32u5/vbhadra01/telemetry

This is the MQTT topic resource used by iot:Publish. The policy does not grant iot:Subscribe or iot:Receive. The STM32 currently needs to publish telemetry, so subscriber permissions are not included in its device policy.

Create the policy and confirm that it appears in the AWS IoT policy list.

Attaching the policy and creating the Thing

Return to the Thing creation page, refresh the policy list and select:

stm32u5-telemetry-publisher-policy

Select Create thing. AWS then creates the following related resources:

• The Thing representing the STM32 device
• An X.509 device certificate
• A private key
• A public key
• The association between the certificate and the Thing
• The association between the policy and the certificate

Downloading the certificate files

After creating the Thing, AWS displays the certificate and key download page.

Download the files before leaving this page. The private key cannot be downloaded again later from the AWS IoT console. The downloaded files include:

• The device certificate
• The device private key
• The corresponding public key
• Amazon Root CA 1
• Amazon Root CA 3

The private key must not be committed to Git, placed in the project repository, copied into project documentation or included in screenshots. Store the downloaded files outside the repository:

~/Documents/IoT_Certs

Restrict access to the directory:

chmod 700 ~/Documents/IoT_Certs

Restrict access to the private-key file to its owner:

chmod 600 ~/Documents/IoT_Certs/<device-private-key-file>

Verify the permissions without displaying the contents of the private key:

stat -c '%A %n' \
    ~/Documents/IoT_Certs \
    ~/Documents/IoT_Certs/<device-private-key-file>

The expected permissions are:

drwx------ /home/<user>/Documents/IoT_Certs
-rw------- /home/<user>/Documents/IoT_Certs/<device-private-key-file>

These permissions prevent other ordinary local users from accessing the directory and private key. They do not replace the need to keep the private key out of source control, documentation, insecure backups or public screenshots.

Confirming the Thing and certificate

After completing the creation process, verify that the Things registry contains:

stm32u5-vbhadra01

Open the Thing details page to verify the registered resource.

Open the Certificates tab and verify that the generated certificate is attached to the Thing and has an Active status.

Open the certificate details and select the Policies tab. Verify that the intended publisher policy is attached:

stm32u5-telemetry-publisher-policy

Obtaining the AWS IoT data endpoint

Each AWS account and Region has an account-specific AWS IoT data endpoint. Obtain the endpoint using the AWS CLI:

aws iot describe-endpoint \
    --endpoint-type iot:Data-ATS \
    --region eu-west-2

The command returned:

{
    "endpointAddress": "a22qxwur84l0fk-ats.iot.eu-west-2.amazonaws.com"
}

This hostname is the AWS IoT Core data endpoint that the MQTT client will use. The endpoint is not a password or private key, but obtain it from the AWS account used for the project rather than copying the example shown in this article. Pass the endpoint to the MQTT client as a hostname:

a22qxwur84l0fk-ats.iot.eu-west-2.amazonaws.com

Do not prefix the hostname with https:// when supplying it to an MQTT client.

Current verified status

The following AWS IoT Core provisioning steps are now complete:

• The Europe (London) Region was selected.
• The stm32u5-vbhadra01 Thing was created.
• An X.509 device certificate was generated.
• The certificate is active and attached to the Thing.
• The restricted publisher policy was created.
• The policy is attached to the certificate.
• The certificate files and private key were downloaded.
• The private key was stored outside the Git repository.
• Local file permissions were restricted.
• The account-specific iot:Data-ATS endpoint was obtained.

This confirms that the required AWS IoT resources exist and are associated correctly.

Next step

The next step is to verify the AWS connection independently using an MQTT client running on Ubuntu. The Ubuntu test will use:

• The account-specific AWS IoT endpoint
• TCP port 8883
• Amazon Root CA 1
• The downloaded device certificate
• The downloaded device private key
• MQTT client ID stm32u5-vbhadra01
• Topic stm32u5/vbhadra01/telemetry

A successful Ubuntu publication will confirm that the client can establish a TLS connection, authenticate with the device certificate and private key, and publish to the permitted topic under the attached AWS IoT policy.

Once that test has succeeded, the project can move to the next stage: adding TLS support to the STM32 networking path and publishing the live sensor JSON directly from the board to AWS IoT Core.

References

1. Amazon Web Services, Create AWS IoT resources, AWS IoT Core Developer Guide. Accessed September 8, 2026.
2. Amazon Web Services, Device communication protocols, AWS IoT Core Developer Guide. Accessed September 8, 2026.
3. Amazon Web Services, AWS IoT Core policy actions, AWS IoT Core Developer Guide. Accessed September 8, 2026.
4. Amazon Web Services, Connect devices to AWS IoT, AWS IoT Core Developer Guide. Accessed September 8, 2026.

Part of the series Secure STM32 home monitoring with Rust