Secure IoT Device Management Using Attribute-Based Access Control in AWS Cloud

IoT deployments produce a steady stream of sensor communication paths that need protecting, especially when the data, which makes device identity, protected communication, data being collected is sensitive. Healthcare deployments are a good example. Devices may report temperature and other patient-related measurements, so only users whose permissions fit the situation should be able to see them. A secure design has to cover two things: the identity of the IoT endpoint and the rights of the person asking for the data. AWS IoT Core offers managed connectivity for IoT devices and supports MQTT messaging. In this project the device proves its identity with an X.509 certificate and sends sensor data over a TLS-protected MQTT connection. Authenticating a device, however, says nothing about which person may read its data. That is an authorization problem. RBAC can grant permissions by role, but an IoT request may also depend on department, location, device type, and access level. ABAC handles this by evaluating several attributes together. Our prototype feeds role, department, location, access level, and device type into the normal access decision. We also demonstrate emergency handling. The Python sensor can flag a reading as an emergency once a configurable threshold of about 40°C is reached. The subscriber then applies a dedicated emergency authorization rule instead of treating the event as an unrestricted bypass. The contributions of this project are: 1. AWS IoT Core connectivity for the simulated sensor. 2. X.509-based device identity verification. 3. TLS-protected MQTT communication. 4. Application-level ABAC for user authorization. 5. Multi-attribute, context-sensitive access decisions. 6. Rejection of requests that fail the configured policy. 7. Controlled emergency access for permitted healthcare roles. 8. Local recording of access decisions. 9. An end-to-end demonstration from sensing through authorization and logging.