Verifying a Provisioned Device

Who should read these docs?

Firmware engineers who have completed provisioning and manufacturing QA verifying a device before shipment.

AWS IoT Console

1. Go to AWS IoT Core → Manage → All devices → Things
2. Search for the device MPBID and confirm the Thing exists with type generic-device in group generic-device-group
3. Go to the Certificates tab → confirm an ACTIVE certificate is attached
4. Click the certificate → Policies tab → confirm all three IoT policies are attached

AWS CLI

export AWS_REGION=us-east-1

aws iot describe-thing --thing-name "FFFF000001"
aws iot list-thing-principals --thing-name "FFFF000001"
aws iot describe-certificate --certificate-id "<cert-id-from-above>"

MQTT Connection Test

Connect with the operational certificate and request the identity shadow. A successful response confirms the certificate is active, the Thing is registered, and the policies are correctly attached.

import json, time
from awscrt import mqtt
from awsiot import mqtt_connection_builder

DEVICE_MPBID         = "FFFF000001"
MQTT_ENDPOINT        = "mqtt.<env>.iot.digital.milwaukeetool.com"  # replace <env> with dev/test/stage/prod
OPERATIONAL_CERT_PEM = "..."  # PEM string
OPERATIONAL_KEY_PEM  = "..."  # PEM string

conn = mqtt_connection_builder.mtls_from_bytes(
    endpoint=MQTT_ENDPOINT,
    cert_bytes=OPERATIONAL_CERT_PEM.encode(),
    pri_key_bytes=OPERATIONAL_KEY_PEM.encode(),
    client_id=DEVICE_MPBID,
    clean_session=False,
    keep_alive_secs=30,
)
conn.connect().result()

received = {"ok": False}
conn.subscribe(
    topic=f"$aws/things/{DEVICE_MPBID}/shadow/name/identity/get/accepted",
    qos=mqtt.QoS.AT_LEAST_ONCE,
    callback=lambda topic, payload, **kw: received.update({"ok": True}),
)[0].result()

conn.publish(
    topic=f"$aws/things/{DEVICE_MPBID}/shadow/name/identity/get",
    payload=json.dumps({}).encode(),
    qos=mqtt.QoS.AT_LEAST_ONCE,
)[0].result()

for _ in range(10):
    if received["ok"]:
        break
    time.sleep(0.5)

conn.disconnect().result()
print("PASS" if received["ok"] else "FAIL: connected but no shadow response")

Verification Checklist

Check	Method	Expected Result
☐ Thing exists	AWS Console or CLI	Found with correct name
☐ Thing type correct	AWS Console or CLI	generic-device
☐ Thing in correct group	AWS Console	generic-device-group
☐ Certificate attached and ACTIVE	AWS Console or CLI	Status shows ACTIVE
☐ Policies attached to operational certificate	AWS Console	iot_default_device_policy, possibly others
☐ MQTT connection works	Test script	Connects without error
☐ Shadow access works	Test script	Shadow response received
☐ Bootstrap cert retained	Device inspection	Both certs in secure storage

Next Steps

• Device Shadows — read and write named shadow state; receive desired-state changes via the delta topic
• Asset Scans — publish Bluetooth asset scan results to the cloud
• OTA Updates — receive and apply over-the-air firmware updates via AWS IoT Jobs
• Operational Certificate Rotation — replace the operational certificate before expiry or in response to a platform-triggered job