Machine cell · L1/L2
SIMATIC S7-1500 → SCALANCE XC208 → S615
F01 · approved reads only; HMI and safety stay local.← Application library
BUNTOP / REFERENCE DESIGN / AWS
Secure OT to AWS architecture
Trace a plant signal through named products, security boundaries and cloud services. Explore what runs locally, what crosses the DMZ and how the design is tested.
One design, explicit boundaries
ISA-95 describes manufacturing functions; the zones below describe trust boundaries. The industrial DMZ is a security convention, not a formal ISA-95 level. Cloud services are classified by function, not added as a new Purdue level.
Plant operations · L2/L3 by function
Kepware → HighByte → local broker, PI and MES
F02 / F03 · one governed event contract, separate system owners.Boundary A · plant to industrial DMZ
SCALANCE SC-600 firewall A
F04 · named source, DMZ endpoint, TLS and publish-only identity.Industrial DMZ · relay zone
Mosquitto → custom adapter → Greengrass V2 + Disk Spooler
F05 · terminate and validate; queue before cloud transfer.Boundary B · industrial DMZ to enterprise / cloud
SCALANCE SC-600 firewall B
F06 · approved AWS endpoint only; no transit to controllers.AWS · managed data and access services
IoT Core → lake and application branches
F07–F11 · scoped service roles, governed datasets and user access.Lake branch
IoT Rule → Data Firehose → S3 raw → Glue validation / curation → S3 Parquet + Glue Catalog → Athena
Lake Formation governs supported table access. Preserve raw evidence and quarantine invalid records.
Application branch
IoT Rule → Lambda validation → DynamoDB → read Lambda → API Gateway REST API → authorized user
Cognito authenticates application users. Conditional writes and event IDs prevent duplicate business records.
Optional paths: Kinesis Data Streams for stream processing; AWS IoT SiteWise for an approved industrial asset and time-series model; SageMaker AI for reviewed analysis. These are alternatives or extensions, not hidden requirements of the baseline.
OT networking: zones, switching, timing and secure connectivity ↗
Products and responsibilities
| ID / placement | Product | Purpose and selection limits | Owner |
|---|---|---|---|
| P01 · Cell | Siemens SIMATIC S7-1500 | Existing machine PLC; native OPC UA where licensed and supported. Preserve controller and safety autonomy. | OT controls |
| P02 · Cell network | Siemens SCALANCE XC208 + S615 | XC208 managed switch for cell connections; S615 firewall for the cell boundary. VLANs alone do not enforce the security boundary. | OT network |
| P03 · Collection | OnLogic Karbon 800 + PTC Kepware Server | Dedicated Windows collector with supported PLC drivers. Use native OPC UA where available; Kepware provides the approved legacy adapter. Exact OS, driver and licenses require compatibility review. | OT integration |
| P04 · Plant context | OnLogic Karbon 800 + HighByte Intelligence Hub | Separate Linux host for OPC UA collection from Kepware/native endpoints, approved asset context and JSON event mapping. Publish local and DMZ copies with bounded durable queues. | OT data owner |
| P05 · Local consumers | Eclipse Mosquitto, AVEVA PI System, Tulip MES | Plant MQTT broker distributes events. PI Data Archive owns agreed time series; Tulip owns approved execution records. Use supported collectors/connectors; API adapters are engineered interfaces. | Application owners |
| P06 · OT / DMZ boundary | Siemens SCALANCE SC-600 family · firewall A | Independent policy boundary. Permit only the named plant publisher to the DMZ MQTT endpoint. Select exact model and redundancy from throughput and availability requirements. | OT security |
| P07 · Industrial DMZ | OnLogic Karbon 800 + Eclipse Mosquitto + AWS IoT Greengrass V2 | DMZ broker terminates plant TLS sessions. A custom Greengrass subscriber validates and forwards events through IoT Core IPC; Disk Spooler persists cloud-bound messages. No IP forwarding or direct PLC route. | OT / IT integration |
| P08 · DMZ / enterprise boundary | Siemens SCALANCE SC-600 family · firewall B | Separate device and rules from firewall A. Allow only approved AWS endpoints and support services from the DMZ. Do not use AWS Network Firewall as a substitute for this plant boundary. | IT security |
| P09 · Cloud ingress | AWS IoT Core | Separate gateway X.509 identity and topic-scoped IoT policy. IoT Rules route selected messages. The telemetry identity cannot receive machine commands. | AWS platform |
| P10 · Lake and queries | Amazon Data Firehose, Amazon S3, AWS Glue, AWS Lake Formation, Amazon Athena | Firehose batches raw events into S3; Glue validates and creates curated Parquet tables; Lake Formation governs supported table access and Athena queries them. | Data engineering |
| P11 · Application path | AWS Lambda, Amazon DynamoDB, Amazon API Gateway, Amazon Cognito | IoT Rule invokes Lambda; validate, quarantine failures and conditionally write by stable event ID. Cognito authorizer protects API Gateway REST API; read Lambda exposes approved queries. | Application team |
| P12 · Cloud security | AWS IAM Identity Center, IAM, KMS, CloudTrail, CloudWatch, AWS IoT Device Defender Audit | Federated administrator access and least privilege; encrypted stores; configured API/data-event audit; operational alarms and IoT policy/certificate audits. Audit is selected; Device Defender Detect is not assumed available to new customers. | Cloud security |
Connection and firewall register
Ports are reference values. Confirm actual endpoint settings before creating rules. Default deny applies between zones; never translate this table into unrestricted forwarding.
| ID | Initiator → destination | Boundary | Service | Identity and restriction |
|---|---|---|---|---|
| F01 | Kepware collector → S7-1500 | Cell firewall S615 | OPC UA TCP 4840 example; confirm endpoint | SignAndEncrypt, trusted certificates, read-only account; approved tags and rate. For legacy native drivers, approve separate protocol rules. |
| F02 | HighByte → Kepware | Plant integration zone | OPC UA TCP 49311 example; confirm installed endpoint | Mutual certificate trust and read-only user. Kepware commonly uses 49311; do not assume every OPC UA endpoint uses 4840. |
| F03 | HighByte → plant Mosquitto | Local information layer | MQTT TLS TCP 8883 | Client certificate; publish only approved telemetry topics. Local consumers subscribe under distinct identities. |
| F04 | HighByte → DMZ Mosquitto | Firewall A · OT to DMZ | MQTT TLS TCP 8883 | Separate client identity, publish-only telemetry ACL, disk-backed sender queue. No command subscription. DMZ broker returns protocol traffic only. |
| F05 | DMZ Greengrass adapter → DMZ broker | DMZ host / service boundary | MQTT TLS TCP 8883 or loopback service binding | Dedicated subscribe-only identity; validate schema, size and topic before forwarding. Adapter is custom engineering, not an automatic feature of Greengrass. |
| F06 | Greengrass → AWS IoT Core | Firewall B · DMZ to cloud | MQTT TLS TCP 8883 | Unique gateway certificate, fixed client ID and topic-scoped publish policy. 443 MQTT requires documented ALPN setup. Outbound initiation still permits bidirectional session traffic. |
| F07 | IoT Core Rule → Firehose → S3 | AWS managed-service boundary | AWS service integrations / HTTPS | Separate service roles limited to delivery stream, bucket prefix and KMS key; configure IoT error action and Firehose failure monitoring. |
| F08 | Glue → raw / curated S3; Athena → curated tables | AWS data access boundary | AWS APIs / HTTPS | Separate transform and query roles; Lake Formation permissions plus aligned IAM, bucket and KMS policies. |
| F09 | IoT Rule → Lambda → DynamoDB | AWS application boundary | AWS service integrations / HTTPS | Schema validation and conditional idempotent writes; error action and quarantine. Stable IDs handle QoS 1 duplicates. |
| F10 | User → API Gateway → Lambda → DynamoDB | User / application boundary | HTTPS TCP 443 | Cognito user pool authorizer on REST API, validated claims and least-privilege read role; no PLC route. |
| F11 | Named admin → AWS; SSM agent → AWS | Separate management boundary | HTTPS TCP 443 | Identity Center federation and MFA; approved hybrid managed DMZ node for Session Manager. No PLC access through this path. Authorize cloud management topics separately from telemetry. |
| F12 | Approved hosts → DNS / time / log services | Explicit support conduits | DNS TCP/UDP 53; NTP UDP 123; HTTPS 443 or TLS syslog 6514 | Only designated resolvers, time sources and collectors. No broad internet DNS/NTP access. Configure and review OS, broker and firewall logs. |
Follow one filler count
This fictional example follows a cumulative good-bottle count of 14,500. The counter is a snapshot, not 14,500 new bottles. A reset or rollover needs a new counter epoch and reconciliation.
- PLC snapshot: count 14,500, source time, quality GOOD and counter epoch.
- Kepware reads the approved tag set; HighByte adds asset, line, order and schema version.
- Plant broker serves local consumers. A separately queued copy crosses firewall A to the DMZ.
- DMZ adapter validates the event and Greengrass queues it durably for IoT Core.
- IoT Core verifies the gateway certificate and policy, then routes the accepted event.
- Raw event enters S3; Lambda conditionally stores the event ID in DynamoDB.
- Athena supports analysis; the authenticated API returns the accepted record and freshness.
Choose a scenario and follow each step. This is a teaching simulation.
{
"event_id": "plant01-line01-filler01-epoch07-000184",
"asset_id": "filler01",
"good_count": 14500,
"counter_epoch": "epoch07",
"sequence": 184,
"source_time": "2026-10-19T14:00:00Z",
"quality": "GOOD",
"unit": "bottles",
"order_id": "DEMO-1042",
"schema_version": 1
}Preserve source time and arrival time. Agree on the authoritative counter location, reset rules and timestamp tolerance before calculating OEE. Invalid or stale data must not appear as current production.
What remains at the plant
| System | Owns | During WAN failure |
|---|---|---|
| PLC / HMI | Machine state, control and interlocks | Continues under local authority. |
| AVEVA PI Data Archive | Agreed operational time-series history | Local capture and visibility continue when local dependencies are healthy. |
| Tulip MES | Approved execution records and workflow | Availability depends on the actual Tulip deployment and network dependencies. Do not promise offline MES execution; define an approved hold or fallback. |
| HighByte + local broker | Context mapping and event distribution | Configured local collection and local consumers continue; cloud copies queue within tested limits. |
| AWS S3 / application store | Cloud raw evidence and curated / serving copies | Cloud values become stale until recovery; they do not become the local production system of record. |
Failure, buffering and recovery
| Failure | Required behavior | Evidence |
|---|---|---|
| Plant to DMZ link lost | Persist the sender copy before acknowledging business delivery. Validate HighByte store-and-forward settings; broker QoS alone is insufficient. | Interrupt F04, restart publisher, compare event IDs and counts. |
| WAN or IoT Core unavailable | Greengrass Disk Spooler retains cloud-bound messages within configured disk limits. Keep critical local work independent. | Disconnect F06, restart host, restore link and reconcile cloud records. |
| DMZ broker / adapter restart | Configure broker persistence, persistent subscriptions and durable handoff. Test the crash window between receipt and cloud spool. | Restart each service with queued events; identify any loss envelope. |
| Duplicates or late delivery | Idempotency key, original source time and defined late-data updates. MQTT QoS 1 does not mean exactly-once business processing. | Replay same event twice; serving count remains one. |
| Disk filling | Alarm before capacity is exhausted; apply an approved critical-data and retention policy. No unlimited-lossless claim. | Capacity alarm and controlled saturation test. |
| Cloud processing failure | Configure IoT Rule error action, Firehose delivery alarms, Lambda failure destination and raw / quarantine reconciliation. | Force destination failure and prove repair plus replay. |
| Power or hardware failure | UPS, disk protection, configuration backup and tested spare / restore plan. Single reference hosts are not high availability. | Power-cycle and restore exercise; record measured recovery. |
OT risk assessment and security operations
Security work starts with the plant’s safety, production and recovery needs. Buntop’s assessment approach connects risk analysis, vulnerability prioritization, controlled patching, monitoring, incident readiness and practical policies to accountable owners and reviewable evidence.
| Capability | Practical work | Deliverable and ownership |
|---|---|---|
| OT risk assessments | Define the system and business scope, inventory assets and approved data flows, review threats and vulnerabilities, and evaluate safety, availability, quality and business consequences. | Risk register, zones / conduits and prioritized mitigation plan. Asset owner approves priorities and residual risk. |
| Vulnerability management | Review vendor advisories and affected versions against actual assets, exposure, exploitability and process criticality. Use passive discovery or approved inventory first; active scans require a reviewed method and window. | Affected-asset list, justified priority, remediation owner, due date, compensating control and accepted exceptions. CVSS alone is not a plant risk decision. |
| Controlled patching | Confirm vendor compatibility; test the patch, application and rollback; verify a recoverable backup; approve the maintenance window; patch in controlled groups and check operation afterward. | Patch record with versions, approval, tests, rollback criteria and monitoring. Operations authorizes the window; the system owner accepts results. |
| OT incident response | Prepare playbooks, escalation, evidence capture, containment choices and restoration checks with operations, controls, safety, IT security and vendors. Exercise the plan before an incident. | Incident roles, contact tree, tabletop results, restoration evidence and lessons learned. Plant authority governs actions that affect production. |
| Policies and procedures | Develop or review access, remote support, change control, patching, backups, removable media, logging, incident handling and supplier responsibilities. | Approved documents with scope, owner, exception process, review date and operating evidence. Procedures state who does what and when. |
| Risk mitigation and verification | Choose proportionate measures such as restricted routes, separate identities, hardened services, monitored access, network segmentation and tested restoration. | Requirement → control → test → evidence mapping. Verify both permitted behavior and denied access, then review residual risk. |
Patch workflow: assess → prove → approve → deploy → verify
- Identify the affected host / controller, firmware, software and operational dependencies.
- Confirm applicability and supplier guidance; define the consequence of acting or deferring.
- Test a representative combination, including HMI / SCADA / MES interfaces and restart behavior.
- Verify backup restoration and rollback. Record any irreversible firmware or database change.
- Agree the maintenance window, operating restrictions, accountable engineer and stop conditions.
- Apply the approved change and verify version, communications, alarms, data quality and local control.
- Update the baseline, close evidence and monitor. If patching is deferred, record a time-bound exception, compensating controls and a review owner.
Do not treat automatic IT updates or an unplanned reboot as an approved OT maintenance process.
Incident workflow: protect people, contain carefully, restore deliberately
- Validate the alert, identify affected assets and notify the agreed incident and plant authorities.
- Assess process safety and operating consequences before disconnecting equipment, stopping services or changing firewall rules.
- Preserve available logs, timestamps, configuration differences and incident decisions through approved evidence handling.
- Contain using the least disruptive effective action approved for the incident; revoke compromised access or restrict a zone where appropriate.
- Investigate and remediate with responsible specialists. Keep change records and confirm the recovery source is trusted.
- Restore in stages, verify process and safety readiness, reconcile required data and obtain operating approval before restart.
- Monitor for recurrence and update the risk register, policies and playbook.
A cyber alert does not by itself justify a blanket power-off. Where safe operation cannot be established, the responsible plant and safety teams determine the hold or stopping response.
Monitoring and protection tools in this design
| Tool / evidence source | What it supports | Coverage boundary |
|---|---|---|
| SCALANCE firewall rules, VPN records and logs | Segmentation, approved remote access and investigation of allowed / denied flows. | A firewall does not replace a passive OT detection system, asset inventory or incident team. |
| Kepware / HighByte diagnostics and approved asset records | Connection health, version / configuration review, data quality and interface ownership. | Connectivity diagnostics are not proof that an asset is free of vulnerabilities. |
| Mosquitto client identities, ACLs, logs and queue metrics | Topic authorization, failed authentication, unexpected clients and delivery health. | Broker visibility is limited to its clients and traffic; it is not plant-wide intrusion detection. |
| FactoryTalk AssetCentre or supported PLC project comparison | Approved logic baseline, configuration drift and supported backup / compare evidence. | Confirm asset support and licensing; a successful backup alone does not prove restoration. |
| AWS IoT Device Defender Audit, CloudWatch and CloudTrail | IoT account / policy checks, configured service logs, alarms and cloud activity evidence. | Cloud controls do not scan plant PLCs or replace OT monitoring. Device Defender Detect is not assumed available to new customers. |
| Client-approved OT visibility and endpoint tools | Passive asset / network observations and supported host protection where required by the site. | Select the product, sensor placement, traffic visibility and response owner after compatibility and risk review. |
Standards, procedures and evidence
Use IEC 62443 as an industrial cybersecurity reference and NIST SP 800-82 for OT security guidance. Select applicable editions and obligations with the client. A standards reference is not a certification, a blanket compliance claim or a substitute for sector-specific legal requirements.
| Reference area | How the assessment uses it |
|---|---|
| IEC 62443-2-1 | Asset-owner security program, responsibilities and operating policies. |
| IEC / ISA 62443-2-3 guidance | Industrial patch management planning and lifecycle practices. |
| IEC 62443-3-2 | System risk assessment, zones, conduits and risk-based security targets. |
| IEC 62443-3-3 | Selection and verification of relevant system security controls. |
| NIST SP 800-82 | OT-specific practices accounting for safety, reliability and operational constraints. |
Keep an evidence register with asset / zone, threat scenario, vulnerability, consequence, existing control, proposed mitigation, owner, target date, approval, residual risk and verification reference. Track exceptions and overdue actions through regular review.
NIST OT security guidance ↗ · ISA / IEC 62443 reference index ↗
Security and management paths
Telemetry and administration use different identities and rules. Cloud deployments to Greengrass are a management capability and require their own authorized channels, maintenance window and rollback. They must not create an unreviewed route to machine commands.
| Control | Named service / product | Implementation and owner |
|---|---|---|
| Human cloud access | AWS IAM Identity Center + federated MFA | Cloud security scopes roles by job, separates production from test and reviews access. |
| Gateway identity | AWS IoT Core certificates + IoT policy | Platform team uses unique gateway identity, expiry / rotation alerts and a tested revoke-and-replace procedure. Greengrass management subscriptions are limited separately. |
| Data encryption | AWS KMS + S3 / DynamoDB encryption | Data owner sets retention and access. OT keys remain in protected local storage; cloud encryption does not protect an exposed edge disk. |
| Audit and alerts | CloudTrail + CloudWatch + IoT Device Defender Audit | Configure relevant CloudTrail events, IoT logging, health metrics and alarms; route to a named incident owner. Audit is not passive OT intrusion detection. |
| DMZ support | AWS Systems Manager Session Manager on an approved hybrid managed node | Named federated user, MFA, IAM limits, plant approval and timeout. Shell-session logs to CloudWatch / S3. SSH and port-forwarding session content is not logged by Session Manager; disable these documents by default. No PLC route. |
| Plant security | SCALANCE logs + broker / host logs | OT security collects denied and permitted flows, configuration changes and authentication failures. A passive OT detection platform remains a separate site selection if required. |
| Cloud network / API protection | VPC security groups; AWS WAF on supported API Gateway REST API stage where required | Security groups apply to VPC resources, not the public IoT endpoint. IoT policy protects MQTT; WAF does not inspect MQTT. AWS Network Firewall is optional for routed VPC inspection. |
Future advisory path with local human approval
SageMaker AI output → authenticated proposal API / review store → approved local review adapter → HMI review → authorized local workflow. This is a separate design, disabled in the baseline. Require allowed actions, role checks, expiry, correlation IDs, replay protection, equipment-state checks and result verification. Safety and interlocks remain local. A model prediction never authorizes a PLC write.
Adjust the sizing assumptions
Estimate event volume and offline storage before choosing hardware or AWS capacity. These are engineering estimates, not AWS prices.
Allow separately for indexes, logs, replication, filesystem reserve and burst traffic. Sampled tags are not automatically one message per tag; define batching and event triggers.
For an AWS estimate, enter region, message sizes and billing units, connection hours, Firehose ingestion, S3 retention and requests, Glue runtime, Athena bytes scanned, Lambda runtime, DynamoDB reads / writes, logs, KMS, user authentication and support. Hardware, licenses, redundant hosts and engineering are additional.
Build a current AWS estimate ↗Commissioning and ownership
Use these checks to plan FAT and SAT. Ticking a box records browser-local planning progress only; it is not test evidence or production approval. For GxP, place approved requirements, results and deviations in the client quality system.
0 of 8 checks marked for planning.
Before purchase: confirm exact hardware models, OS and firmware, licenses, supported combinations, throughput, redundancy, geography, retention, spare parts, patch windows and support agreements.
Product references
Official starting points for product capabilities and configuration. Validate versions and regional service availability during detailed design.
- Siemens security appliances ↗
- Siemens SCALANCE XC208 ↗
- OnLogic Karbon 800 ↗
- Kepware service ports ↗
- HighByte connections ↗
- HighByte MQTT ↗
- Mosquitto configuration ↗
- AWS Greengrass Disk Spooler ↗
- AWS IoT protocols and ports ↗
- IoT Rule to Firehose ↗
- Device Defender Audit ↗
- Session Manager logging limits ↗
- Optional SiteWise OPC UA collection ↗
OT networking: zones, switching, timing and secure connectivity ↗