{"id":40387,"date":"2025-12-22T10:00:00","date_gmt":"2025-12-22T15:00:00","guid":{"rendered":"https:\/\/www.dmcinfo.com\/?p=40387"},"modified":"2026-01-20T17:22:43","modified_gmt":"2026-01-20T22:22:43","slug":"siemens-mqtt-setup-with-aws-iot-core","status":"publish","type":"post","link":"https:\/\/www.dmcinfo.com\/blog\/40387\/siemens-mqtt-setup-with-aws-iot-core\/","title":{"rendered":"Siemens MQTT Setup with AWS IoT Core"},"content":{"rendered":"\n

As technology advances and security standards improve, clients in the automation industry are transitioning to newer communications standards for both future-proofing and improved plant security.\u00a0This blog covers the implementation of the MQTT standard, which is known for being simple, secure, and lightweight, with the AWS IoT Core service and the Siemens LMQTT library. The primary goal of this blog is to provide a centralized resource to demystify the setup process.<\/p>\n\n\n\n

Note: This blog uses a Siemens S71214 G2 PLC and TIA Portal V20 Update 3, with version 2.3.0 the Siemens \u201cLibraries for Communication\u201d.<\/em><\/p>\n\n\n\n

Why Certificates?<\/h2>\n\n\n\n

Instead of user credentials, which can be easily compromised, the industry is slowly shifting towards more secure certificate-based security. Certificates are authorized and signed by a \u201cCertificate Authority\u201d (CA) and come with a public and private key.<\/p>\n\n\n\n

A public key is shared openly to encrypt data or verify signatures, while the private key is stored locally by the certificate owner to decrypt data and create signatures, enabling secure communications.<\/p>\n\n\n\n

Typically, an MQTT connection is secured through TLS and leverages a unique certificate per device. Devices can share the same certificate, but if one of the certificates is compromised, all devices will need to have their certificates updated.<\/p>\n\n\n\n

What’s the Catch?<\/h3>\n\n\n\n

One way that certificates are more secure is that they have limited lifespans. Each certificate has a specified time frame (usually a decade or more, up to a limit) where it is valid. Upon expiration, communications relying on the certificate will fail until a new certificate is signed by the CA and manually rotated on the device. For Siemens PLCs, this is a manual process that requires a hardware download and downtime.<\/p>\n\n\n\n

A similar lifespan issue arises for the CA. The current Amazon Root CA 1 at the time of writing expires January 2038 and has a lifespan of 10-20 years.<\/p>\n\n\n\n

However, AWS helps with mitigating this issue by allowing users to remotely monitor and even revoke certificates.<\/p>\n\n\n\n

Configuring AWS IoT Core<\/h2>\n\n\n\n

In AWS IoT Core, every device is registered as a Thing and has associated certificates to secure the communications and \u201cPolicies\u201d to determine the permissions a certificate is allowed to have. Before the PLC can communicate with AWS, it must first be configured in the IoT Core with at least one of each (Thing, Certificate, Policy).<\/p>\n\n\n\n

Note: It is possible to use user credentials with AWS, but this is less secure and requires the configuration of a custom authorizer and downloading the Amazon Root Certificate to the PLC. More information can be found here: <\/em>Use API Gateway Lambda authorizers – Amazon API Gateway<\/em><\/a>.<\/em><\/p>\n\n\n\n

Creating a Thing<\/h3>\n\n\n\n

A Thing can be created under the \u201cManage > All devices > Things\u201d menu. Creating a Thing will prompt the user to assign a certificate and a policy. In this example, an auto-generated AWS certificate was used.<\/p>\n\n\n\n

\"creating<\/figure>\n\n\n\n

Creating a Policy<\/h3>\n\n\n\n

As part of the steps to create a Thing, you can also create a Policy. Policies are used to Allow\/Deny actions that a device can perform when connected using the attached certificate. A policy can be reused across multiple certificates, and a certificate can have multiple attached policies, allowing for flexible configuration.<\/p>\n\n\n\n

For testing basic communications and setup, it is recommended that an unrestricted policy be used to allow all policy actions and resources to be accessed (notated by the wildcard character, *). Policies can be updated at any time to remotely modify the permissions of any device.<\/p>\n\n\n\n

\"Creating<\/figure>\n\n\n\n

Note: For more information regarding policy configuration, see <\/em>AWS IoT Core policy examples – AWS IoT Core<\/em><\/a>.<\/em><\/p>\n\n\n\n

Creating your Certificates<\/h3>\n\n\n\n

Once a Thing has been created, a pop-up will appear with download links to the generated certificates. Click the \u201cDownload All\u201d button to download a copy of the certificate, keys, and root CA certificates. Don\u2019t close the dialog box without downloading a copy of the certificate and keys, as this is the only time they are available for security reasons!<\/p>\n\n\n\n

\"creating<\/figure>\n\n\n\n

Configuring the Siemens PLC<\/h2>\n\n\n\n

Configuring the PLC to communicate via MQTT requires 3 steps. First, the LMQTT library must be added to the project and configured for the connection. Next, project security must be enabled to allow the user to access the \u201cCertificate Manager\u201d and import the certificates to the project.<\/p>\n\n\n\n

Note: More information and a detailed guide of each step can be found here: <\/em>Use the SIMATIC controller as an MQTT client – ID: 109748872 – Industry Support Siemens<\/em><\/a>.<\/em><\/p>\n\n\n\n

Adding the Library to the Project<\/h3>\n\n\n\n

The LMQTT Library and documentation can be found as part of the communications library here: SIMATIC S7-1500\/S7-1200 Libraries for Communication (LCommSuite) – ID: 109780503 – Industry Support Siemens<\/a><\/p>\n\n\n\n

After downloading the Siemens Libraries for Communication, unzip the file and move the resulting folder to a permanent location. Then, import the \u201cLibraries_Comm_Controller.al20\u201d as a global library into your project.<\/p>\n\n\n\n

\"Adding<\/figure>\n\n\n\n

The communications library will then appear. For this blog, only the LMQTT library objects are used. Drag and drop the \u201cLMQTT_Client\u201d object from the Global Library into the \u201cProgram blocks\u201d folder of your PLC. All dependencies will automatically be imported into the project along with the library block.<\/p>\n\n\n\n

\"library<\/figure>\n\n\n\n

Creating a Data Block<\/em><\/h3>\n\n\n\n

Next, create a Global Data Block to hold the tag values of the LMQTT Client. This can be done by expanding the \u201cProgram blocks\u201d folder in the Project tree and clicking \u201cAdd new block\u201d. From the dialog box, select \u201cData Block\u201d, name the block, and choose \u201cGlobal DB\u201d.<\/p>\n\n\n\n

\"creating<\/figure>\n\n\n\n

The Data Block used by our example project is shown below. Some notes on our implementation:<\/p>\n\n\n\n