How to use Shared Access Policy to restrict access of IoT Edge to IoT Hub

Question

Hi,

We are using an IoT Edge Device which sends D2C message to IoT Hub, can we restrict the access to IoT Hub from IoT Edge using the shared access policy and built-in end-points, for example the shared access policy with name iothubowner is having all access, so is the IoT edge have all those permissions?

Answer 1

Hello @Satyam Chauhan ,

It is a best practice to follow the principle of least privilege in any solution. Therefore, different shared access policies exist, one for the iothubowner (think about "root" or admin), one for services to consume messages from the built-in service endpoints, one for devices to connect and communicate through the device facing endpoints and special policies for device management solutions like registryRead to list the device registry contents, registryReadWrite to read and create new entries in the device registry (create new devices) and a special deviceupdateservice policy what combines device, service and registryRead.

There is a great documentation on how to control and secure access to IoT Hub. I recommend reading Control access with Azure AD for service APIs as it simplifies management compared to security tokens.

----------

Please don't forget to click on "best answer" or "upvote" button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer.