[SlowRobotAhead]

I’m working on IoT Core. It’s good, about what you would expect.

Most everything is solid. Typical AWS issues that there are policy things that only “make sense” (loosely) after you’ve failed at them many times.

My specific annoyance right now is that there is no cross-region compatibility, and the Device Registry has no backup and restore, so you are on your own if you want to take your device registry, back it up, and deploy to a different region.

I haven’t used the Device Shadows because it’s outside my use case but seems like a feature most people would want.

I have no major complaints.

[GordonS]

From the Azure side, I'm also pretty happy with it. I only really have 2 gripes.

First, the docs make it sound much harder than it really is, especially around certificates and device registration.

Second, the limitations. I don't know what AWS is like, but Azure loves their limitations. For a service that's meant to scale globally, it's a real PITA for some deployments. It's not an issue for many, but when it is, you're constantly trying to come up with clever ways to avoid them.

[SlowRobotAhead]

Our use cases are almost certainly different, but I can think of no ways I’ve had to workaround or deal with scaling. AWS seems super happy to let you use as much data as you possibly can (obviously).

Yes, registration can be complex! JIT reg, JIT provision, PSK reg at birth, certs, keys, tokens. We’re even doing something really goofy because our device never touched the internet directly, always through a middleman, so it’s been double complex and revolves around custom authorization and temporary tokens. I see how we could simplify by doing JIT-R with PKI but don’t have the resources on the device. I don’t fault the providers for making it seem like it’s complex, it definitely can be!

I suppose it’s annoying that a “job” in AWS costs $0.03 per device, and that can be any issued job using their API. So you “could” use their setup to reset() but mostly it’s their OTA Update agent which is good, but when you’re looking at 100k eventual devices, every firmware update is $3k. Which is also fine if it’s an update you need. If it isn’t, you threw away $3k. The OTA Agent is very good though, rollbacks, logging, canary rollout, etc.

I worked right with AWS on this project so Azure or GCP wasn’t an option. And now I know the system so it’s unlikely as a small team I’ll look into Azure next time. But I guess that’s how it goes.

[loganwedwards]

+1 on the "Typical AWS issues" regarding policies. Even Amazon's own examples tend to confuse the issue more and it is typically after much trial and error do you attain the sweet spot for sensible policies that prioritize security. My only other gripe is MQTT retain is not supported, although as mentioned Device Shadows do provide this type of feature.

[SlowRobotAhead]

You wonder how many people just * some aspects of production?

First thing we do when there is an issue in Dev is to * the policy out.