{
  "title": "Buntop secure OT to AWS reference architecture",
  "status": "Reference selections; subject to site review; not installed or validated",
  "reviewed": "2026-10-19",
  "products": [
    {
      "id_placement": "P01 \u00b7 Cell",
      "product": "Siemens SIMATIC S7-1500",
      "purpose": "Existing machine PLC; native OPC UA where licensed and supported. Preserve controller and safety autonomy.",
      "owner": "OT controls"
    },
    {
      "id_placement": "P02 \u00b7 Cell network",
      "product": "Siemens SCALANCE XC208 + S615",
      "purpose": "XC208 managed switch for cell connections; S615 firewall for the cell boundary. VLANs alone do not enforce the security boundary.",
      "owner": "OT network"
    },
    {
      "id_placement": "P03 \u00b7 Collection",
      "product": "OnLogic Karbon 800 + PTC Kepware Server",
      "purpose": "Dedicated Windows collector with supported PLC drivers. Use native OPC UA where available; Kepware provides the approved legacy adapter. Exact OS, driver and licenses require compatibility review.",
      "owner": "OT integration"
    },
    {
      "id_placement": "P04 \u00b7 Plant context",
      "product": "OnLogic Karbon 800 + HighByte Intelligence Hub",
      "purpose": "Separate Linux host for OPC UA collection from Kepware/native endpoints, approved asset context and JSON event mapping. Publish local and DMZ copies with bounded durable queues.",
      "owner": "OT data owner"
    },
    {
      "id_placement": "P05 \u00b7 Local consumers",
      "product": "Eclipse Mosquitto, AVEVA PI System, Tulip MES",
      "purpose": "Plant MQTT broker distributes events. PI Data Archive owns agreed time series; Tulip owns approved execution records. Use supported collectors/connectors; API adapters are engineered interfaces.",
      "owner": "Application owners"
    },
    {
      "id_placement": "P06 \u00b7 OT / DMZ boundary",
      "product": "Siemens SCALANCE SC-600 family \u00b7 firewall A",
      "purpose": "Independent policy boundary. Permit only the named plant publisher to the DMZ MQTT endpoint. Select exact model and redundancy from throughput and availability requirements.",
      "owner": "OT security"
    },
    {
      "id_placement": "P07 \u00b7 Industrial DMZ",
      "product": "OnLogic Karbon 800 + Eclipse Mosquitto + AWS IoT Greengrass V2",
      "purpose": "DMZ broker terminates plant TLS sessions. A custom Greengrass subscriber validates and forwards events through IoT Core IPC; Disk Spooler persists cloud-bound messages. No IP forwarding or direct PLC route.",
      "owner": "OT / IT integration"
    },
    {
      "id_placement": "P08 \u00b7 DMZ / enterprise boundary",
      "product": "Siemens SCALANCE SC-600 family \u00b7 firewall B",
      "purpose": "Separate device and rules from firewall A. Allow only approved AWS endpoints and support services from the DMZ. Do not use AWS Network Firewall as a substitute for this plant boundary.",
      "owner": "IT security"
    },
    {
      "id_placement": "P09 \u00b7 Cloud ingress",
      "product": "AWS IoT Core",
      "purpose": "Separate gateway X.509 identity and topic-scoped IoT policy. IoT Rules route selected messages. The telemetry identity cannot receive machine commands.",
      "owner": "AWS platform"
    },
    {
      "id_placement": "P10 \u00b7 Lake and queries",
      "product": "Amazon Data Firehose, Amazon S3, AWS Glue, AWS Lake Formation, Amazon Athena",
      "purpose": "Firehose batches raw events into S3; Glue validates and creates curated Parquet tables; Lake Formation governs supported table access and Athena queries them.",
      "owner": "Data engineering"
    },
    {
      "id_placement": "P11 \u00b7 Application path",
      "product": "AWS Lambda, Amazon DynamoDB, Amazon API Gateway, Amazon Cognito",
      "purpose": "IoT Rule invokes Lambda; validate, quarantine failures and conditionally write by stable event ID. Cognito authorizer protects API Gateway REST API; read Lambda exposes approved queries.",
      "owner": "Application team"
    },
    {
      "id_placement": "P12 \u00b7 Cloud security",
      "product": "AWS IAM Identity Center, IAM, KMS, CloudTrail, CloudWatch, AWS IoT Device Defender Audit",
      "purpose": "Federated administrator access and least privilege; encrypted stores; configured API/data-event audit; operational alarms and IoT policy/certificate audits. Audit is selected; Device Defender Detect is not assumed available to new customers.",
      "owner": "Cloud security"
    }
  ],
  "connections": [
    {
      "id": "F01",
      "initiator_destination": "Kepware collector \u2192 S7-1500",
      "boundary": "Cell firewall S615",
      "service": "OPC UA TCP 4840 example; confirm endpoint",
      "restriction": "SignAndEncrypt, trusted certificates, read-only account; approved tags and rate. For legacy native drivers, approve separate protocol rules."
    },
    {
      "id": "F02",
      "initiator_destination": "HighByte \u2192 Kepware",
      "boundary": "Plant integration zone",
      "service": "OPC UA TCP 49311 example; confirm installed endpoint",
      "restriction": "Mutual certificate trust and read-only user. Kepware commonly uses 49311; do not assume every OPC UA endpoint uses 4840."
    },
    {
      "id": "F03",
      "initiator_destination": "HighByte \u2192 plant Mosquitto",
      "boundary": "Local information layer",
      "service": "MQTT TLS TCP 8883",
      "restriction": "Client certificate; publish only approved telemetry topics. Local consumers subscribe under distinct identities."
    },
    {
      "id": "F04",
      "initiator_destination": "HighByte \u2192 DMZ Mosquitto",
      "boundary": "Firewall A \u00b7 OT to DMZ",
      "service": "MQTT TLS TCP 8883",
      "restriction": "Separate client identity, publish-only telemetry ACL, disk-backed sender queue. No command subscription. DMZ broker returns protocol traffic only."
    },
    {
      "id": "F05",
      "initiator_destination": "DMZ Greengrass adapter \u2192 DMZ broker",
      "boundary": "DMZ host / service boundary",
      "service": "MQTT TLS TCP 8883 or loopback service binding",
      "restriction": "Dedicated subscribe-only identity; validate schema, size and topic before forwarding. Adapter is custom engineering, not an automatic feature of Greengrass."
    },
    {
      "id": "F06",
      "initiator_destination": "Greengrass \u2192 AWS IoT Core",
      "boundary": "Firewall B \u00b7 DMZ to cloud",
      "service": "MQTT TLS TCP 8883",
      "restriction": "Unique gateway certificate, fixed client ID and topic-scoped publish policy. 443 MQTT requires documented ALPN setup. Outbound initiation still permits bidirectional session traffic."
    },
    {
      "id": "F07",
      "initiator_destination": "IoT Core Rule \u2192 Firehose \u2192 S3",
      "boundary": "AWS managed-service boundary",
      "service": "AWS service integrations / HTTPS",
      "restriction": "Separate service roles limited to delivery stream, bucket prefix and KMS key; configure IoT error action and Firehose failure monitoring."
    },
    {
      "id": "F08",
      "initiator_destination": "Glue \u2192 raw / curated S3; Athena \u2192 curated tables",
      "boundary": "AWS data access boundary",
      "service": "AWS APIs / HTTPS",
      "restriction": "Separate transform and query roles; Lake Formation permissions plus aligned IAM, bucket and KMS policies."
    },
    {
      "id": "F09",
      "initiator_destination": "IoT Rule \u2192 Lambda \u2192 DynamoDB",
      "boundary": "AWS application boundary",
      "service": "AWS service integrations / HTTPS",
      "restriction": "Schema validation and conditional idempotent writes; error action and quarantine. Stable IDs handle QoS 1 duplicates."
    },
    {
      "id": "F10",
      "initiator_destination": "User \u2192 API Gateway \u2192 Lambda \u2192 DynamoDB",
      "boundary": "User / application boundary",
      "service": "HTTPS TCP 443",
      "restriction": "Cognito user pool authorizer on REST API, validated claims and least-privilege read role; no PLC route."
    },
    {
      "id": "F11",
      "initiator_destination": "Named admin \u2192 AWS; SSM agent \u2192 AWS",
      "boundary": "Separate management boundary",
      "service": "HTTPS TCP 443",
      "restriction": "Identity Center federation and MFA; approved hybrid managed DMZ node for Session Manager. No PLC access through this path. Authorize cloud management topics separately from telemetry."
    },
    {
      "id": "F12",
      "initiator_destination": "Approved hosts \u2192 DNS / time / log services",
      "boundary": "Explicit support conduits",
      "service": "DNS TCP/UDP 53; NTP UDP 123; HTTPS 443 or TLS syslog 6514",
      "restriction": "Only designated resolvers, time sources and collectors. No broad internet DNS/NTP access. Configure and review OS, broker and firewall logs."
    }
  ],
  "equipment_guide": "/industrial-edge-stack.html",
  "architecture_chart": "/industrial-edge-stack.svg"
}