--- title: AWS IoT Core description: >- A managed cloud platform facilitating secure interactions between connected devices, cloud applications, and devices. breadcrumbs: Docs > Integrations > AWS IoT Core --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # AWS IoT Core Integration version1.1.0 {% callout %} # Important note for users on the following Datadog sites: us2.ddog-gov.com {% alert level="info" %} To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator. To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com). {% /alert %} {% /callout %} ## Overview{% #overview %} AWS IoT Core is a managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices. Enable this integration to see in Datadog all your IOT metrics. ## Setup{% #setup %} ### Installation{% #installation %} If you haven't already, set up the [Amazon Web Services integration first](https://docs.datadoghq.com/integrations/amazon_web_services.md). ### Metric collection{% #metric-collection %} 1. In the [AWS integration page](https://app.datadoghq.com/integrations/amazon-web-services), ensure that `IoT` is enabled under the `Metric Collection` tab. 1. Install the [Datadog - AWS IoT Core integration](https://app.datadoghq.com/integrations/amazon-iot). ### Log collection{% #log-collection %} #### Enable logging{% #enable-logging %} Configure AWS IoT Core to send logs either to a S3 bucket or to CloudWatch. **Note**: If you log to a S3 bucket, make sure that `amazon_iot` is set as *Target prefix*. #### Send logs to Datadog{% #send-logs-to-datadog %} **Note**: Datadog's [automatic trigger setup](https://docs.datadoghq.com/logs/guide/send-aws-services-logs-with-the-datadog-lambda-function.md?tab=awsconsole#automatically-set-up-triggers) is available for CloudWatch log groups only. For S3 buckets, use the [manual trigger setup](https://docs.datadoghq.com/logs/guide/send-aws-services-logs-with-the-datadog-lambda-function.md#collecting-logs-from-s3-buckets). If you use the automatic trigger setup, ensure that your [Datadog IAM policy](https://docs.datadoghq.com/integrations/amazon_web_services.md#installation) has the following permissions: | AWS Permission | Description | | ------------------------- | ------------------------------------- | | `iot:GetV2LoggingOptions` | Used to retrieve IoT logging options. | 1. If you haven't already, set up the [Datadog Forwarder Lambda function](https://docs.datadoghq.com/logs/guide/forwarder.md). 1. Once the Lambda function is installed, manually add a trigger on the S3 bucket or CloudWatch log group that contains your AWS IoT Core logs in the AWS console: - [Add a manual trigger on the S3 bucket](https://docs.datadoghq.com/logs/guide/send-aws-services-logs-with-the-datadog-lambda-function.md#collecting-logs-from-s3-buckets) - [Add a manual trigger on the CloudWatch Log Group](https://docs.datadoghq.com/logs/guide/send-aws-services-logs-with-the-datadog-lambda-function.md#collecting-logs-from-cloudwatch-log-group) ## Data Collected{% #data-collected %} ### Metrics{% #metrics %} | | | | | **aws.iot.approximate_number_of_things_registered**(gauge) | The approximate number of IoT things registered by fleet provisioning.*Shown as device* | | **aws.iot.behavior_evaluation_completed**(count) | The number of completed evaluations of a security profile behavior. | | **aws.iot.behavior_evaluation_skipped**(count) | The number of skipped evaluations of a security profile behavior. | | **aws.iot.canceled_job_execution_count**(count) | The number of job executions whose status changed to CANCELED within the CloudWatch period.*Shown as execution* | | **aws.iot.canceled_job_execution_total_count**(gauge) | The total number of job executions whose status is CANCELED for the job.*Shown as execution* | | **aws.iot.client_error_count**(count) | The number of client errors generated while executing the job.*Shown as error* | | **aws.iot.cloudwatch_logs_log_group_creation_failed**(count) | The number of CreateLogGroup request failures from AWS IoT logging.*Shown as error* | | **aws.iot.cloudwatch_logs_put_log_events_failed**(count) | The number of PutLogEvents request failures from AWS IoT logging.*Shown as error* | | **aws.iot.cmk_branch_key_rotation_health**(gauge) | Indicates whether the AWS Key Management Service (KMS) access role has the permissions required for branch key rotation. A value of 1 means rotation can proceed, and a value of 0 means it cannot. | | **aws.iot.cmk_health**(gauge) | The health of the customer managed key used by AWS IoT Core. A value of 1 means the key is healthy, and a value of 0 means AWS IoT Core cannot use the key. | | **aws.iot.connect_auth_error**(count) | AWS IoT could not authorize a connect request from a client on an MQTT topic.*Shown as error* | | **aws.iot.connection_authn_error**(count) | The number of connection attempts which AWS IoT Core rejects due to authentication failures.*Shown as error* | | **aws.iot.connect_client_error**(count) | AWS IoT rejected a connect request from a client on an MQTT topic because the MQTT message did not meet the requirements defined in AWS IoT Limits.*Shown as error* | | **aws.iot.connect_client_idthrottle**(count) | AWS IoT did not process a client connect request on an MQTT topic because the client exceeded the allowed connect request rate for a specific client ID. | | **aws.iot.connect_server_error**(count) | AWS IoT failed to process a client connect request on an MQTT topic because an internal error occurred.*Shown as error* | | **aws.iot.connect_success**(count) | AWS IoT successfully processed a client connect request on an MQTT topic. | | **aws.iot.connect_throttle**(count) | AWS IoT did not process a connect request on an MQTT topic because the account exceeded the allowed connect request rate. | | **aws.iot.create_certificate_from_csr_failed**(count) | The number of failed calls to the CreateCertificateFromCsr MQTT API.*Shown as error* | | **aws.iot.create_keys_and_certificate_failed**(count) | The number of failed calls to the CreateKeysAndCertificate MQTT API.*Shown as error* | | **aws.iot.credential_exchange_success**(count) | The number of successful AssumeRoleWithCertificate requests to AWS IoT Core credentials provider. | | **aws.iot.delete_thing_shadow_accepted**(count) | AWS IoT received a DeleteThingShadow request.*Shown as request* | | **aws.iot.error_action_failure**(count) | The number of failed error actions. | | **aws.iot.error_action_success**(count) | The number of successful error actions. | | **aws.iot.failed_job_execution_count**(count) | The number of job executions whose status changed to FAILED within the CloudWatch period.*Shown as execution* | | **aws.iot.failed_job_execution_total_count**(gauge) | The total number of job executions whose status is FAILED for the job.*Shown as execution* | | **aws.iot.failure**(count) | The number of failed rule action invocations. | | **aws.iot.get_thing_shadow_accepted**(count) | AWS IoT received a GetThingShadow request.*Shown as request* | | **aws.iot.http_code_4xx**(count) | Generated if the status code of the response from the downstream web service or application is between 400 and 499. | | **aws.iot.http_code_5xx**(count) | Generated if the status code of the response from the downstream web service or application is between 500 and 599. | | **aws.iot.http_request_timeout**(count) | Generated if the downstream web service or application does not return a response within the request timeout limit. | | **aws.iot.http_unknown_host**(count) | Generated if the URL is valid, but the service does not exist or is unreachable. | | **aws.iot.in_progress_job_execution_count**(count) | The number of job executions whose status changed to IN_PROGRESS within the CloudWatch period.*Shown as execution* | | **aws.iot.in_progress_job_execution_total_count**(gauge) | The total number of job executions whose status is IN_PROGRESS for the job.*Shown as execution* | | **aws.iot.list_named_shadows_for_thing_accepted**(count) | AWS IoT received a ListNamedShadowsForThing request.*Shown as request* | | **aws.iot.misconfigured_device_defender_notification**(gauge) | Indicates that the Amazon Simple Notification Service (SNS) configuration for AWS IoT Device Defender is misconfigured. | | **aws.iot.non_compliant_resources**(gauge) | The number of resources found to be noncompliant with an audit check.*Shown as resource* | | **aws.iot.num_of_metrics_exported**(count) | The number of metrics exported for a cloud-side, device-side, or custom metric. | | **aws.iot.num_of_metrics_skipped**(count) | The number of metrics skipped for export due to insufficient permissions provided to AWS IoT Device Defender. | | **aws.iot.parse_error**(count) | The number of JSON parse errors that occurred in messages published on a topic on which a rule is listening. | | **aws.iot.ping_success**(count) | AWS IoT received a ping message. | | **aws.iot.provision_thing_client_error**(count) | The number of times a device failed to provision due to a client error.*Shown as error* | | **aws.iot.provision_thing_success**(count) | The number of times a device was successfully provisioned.*Shown as success* | | **aws.iot.publish_in_auth_error**(count) | AWS IoT could not authorize a publish request from a client.*Shown as error* | | **aws.iot.publish_in_client_error**(count) | AWS IoT rejected a publish request from a client because the MQTT message did not meet the requirements defined in AWS IoT Limits.*Shown as error* | | **aws.iot.publish_in_server_error**(count) | AWS IoT failed to process a client publish request because an internal error occurred.*Shown as error* | | **aws.iot.publish_in_success**(count) | A client successfully published an MQTT message. | | **aws.iot.publish_in_throttle**(count) | AWS IoT did not process a client publish request because the client exceeded the allowed inbound message rate. | | **aws.iot.publish_out_auth_error**(count) | AWS IoT could not authorize the publish request from the message broker.*Shown as error* | | **aws.iot.publish_out_client_error**(count) | AWS IoT rejected the publish out request from the message broker because the MQTT message did not meet the requirements defined in AWS IoT Limits.*Shown as error* | | **aws.iot.publish_out_server_error**(count) | The number of outbound publish requests the message broker failed to process because of an internal error.*Shown as error* | | **aws.iot.publish_out_success**(count) | AWS IoT successfully published a message to the connected client. | | **aws.iot.publish_out_throttle**(count) | The number of publish requests that were throttled because the client exceeded the allowed outbound message rate. | | **aws.iot.publish_retained_auth_error**(count) | The number of publish requests with the `retain` flag set that the message broker was unable to authorize. | | **aws.iot.publish_retained_server_error**(count) | The number of retained publish requests the message broker failed to process because of an internal error.*Shown as error* | | **aws.iot.publish_retained_success**(count) | The number of publish requests with the `retain` flag set that were successfully processed by the message broker. | | **aws.iot.publish_retained_throttle**(count) | The number of publish requests with the `retain` flag set that were throttled because the client exceeded the allowed inbound message rate. | | **aws.iot.queued_job_execution_count**(count) | The number of job executions whose status changed to QUEUED within the CloudWatch period.*Shown as execution* | | **aws.iot.queued_job_execution_total_count**(gauge) | The total number of job executions whose status is QUEUED for the job.*Shown as execution* | | **aws.iot.queued_server_error**(count) | The number of messages that haven't been stored for a persistent session because of an internal error. | | **aws.iot.queued_success**(count) | The number of stored messages that were successfully processed by the message broker for clients that were disconnected from their persistent session. | | **aws.iot.queued_throttle**(count) | The number of messages that couldn't be stored and were throttled while clients with persistent sessions were disconnected. | | **aws.iot.register_thing_failed**(count) | The number of failed calls to the RegisterThing MQTT API.*Shown as error* | | **aws.iot.rejected_job_execution_count**(count) | The number of job executions whose status changed to REJECTED within the CloudWatch period.*Shown as execution* | | **aws.iot.rejected_job_execution_total_count**(gauge) | The total number of job executions whose status is REJECTED for the job.*Shown as execution* | | **aws.iot.removed_job_execution_total_count**(gauge) | The total number of job executions whose status is REMOVED for the job.*Shown as execution* | | **aws.iot.request_timeout**(count) | The number of rule action requests that timed out.*Shown as timeout* | | **aws.iot.resources_evaluated**(gauge) | The number of resources evaluated for compliance by an audit check.*Shown as resource* | | **aws.iot.retrieve_ocsp_staple_data_success**(count) | The number of Online Certificate Status Protocol (OCSP) responses received and processed successfully for a domain configuration.*Shown as success* | | **aws.iot.rule_evaluation**(count) | The number of rule evaluations that were throttled. | | **aws.iot.rule_message_throttled**(count) | The number of messages throttled by the rules engine because of malicious behavior or because the number of messages exceeds the rules engine's throttle limit. | | **aws.iot.rule_not_found**(count) | The count of rules which could not be found. | | **aws.iot.rules_executed**(count) | The number of AWS IoT rules executed. | | **aws.iot.subscribe_auth_error**(count) | AWS IoT could not authorize a subscribe request from a client on an MQTT topic.*Shown as error* | | **aws.iot.subscribe_client_error**(count) | AWS IoT rejected a subscribe request from a client on an MQTT topic because the MQTT message did not meet the requirements defined in AWS IoT Limits.*Shown as error* | | **aws.iot.subscribe_server_error**(count) | AWS IoT failed to process a client subscribe request on an MQTT topic because an internal error occurred.*Shown as error* | | **aws.iot.subscribe_success**(count) | AWS IoT successfully processed a client subscribe request on an MQTT topic. | | **aws.iot.subscribe_throttle**(count) | AWS IoT did not process a client subscribe request on an MQTT topic because the client exceeded the allowed subscribe request rate. | | **aws.iot.succeeded_job_execution_count**(count) | The number of job executions whose status changed to SUCCESS within the CloudWatch period.*Shown as execution* | | **aws.iot.succeeded_job_execution_total_count**(gauge) | The total number of job executions whose status is SUCCESS for the job.*Shown as execution* | | **aws.iot.success**(count) | The number of successful rule action invocations. | | **aws.iot.throttle_exceeded**(count) | The number of successful rule action invocations. | | **aws.iot.timed_out_job_execution_total_count**(gauge) | The total number of job executions whose status is TIMED_OUT for the job.*Shown as execution* | | **aws.iot.topic_match**(count) | The number of incoming messages published on a topic on which a rule is listening. | | **aws.iot.unsubscribe_client_error**(count) | AWS IoT rejected an unsubscribe request from a client on an MQTT topic because the MQTT message did not meet the requirements defined in AWS IoT Limits.*Shown as error* | | **aws.iot.unsubscribe_server_error**(count) | AWS IoT failed to process a client unsubscribe request on an MQTT topic because an internal error occurred.*Shown as error* | | **aws.iot.unsubscribe_success**(count) | AWS IoT successfully processed a client unsubscribe request on an MQTT topic. | | **aws.iot.unsubscribe_throttle**(count) | AWS IoT did not process a client unsubscribe request on an MQTT topic because the client exceeded the allowed unsubscribe request rate. | | **aws.iot.update_thing_shadow_accepted**(count) | AWS IoT received a UpdateThingShadow request.*Shown as request* | | **aws.iot.violations**(count) | The number of new violations of security profile behaviors found since the last evaluation. | | **aws.iot.violations_cleared**(count) | The number of violations of security profile behaviors resolved since the last evaluation. | | **aws.iot.violations_invalidated**(count) | The number of violations of security profile behaviors for which information is no longer available since the last evaluation. | Each of the metrics retrieved from AWS are assigned the same tags that appear in the AWS console, including but not limited to host name, security-groups, and more. ### Events{% #events %} The AWS IoT Core integration does not include any events. ### Service Checks{% #service-checks %} The AWS IoT Core integration does not include any service checks. ## Troubleshooting{% #troubleshooting %} Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).