How to programmatically retrieve the public key for a Thing in AWS IoT Core?

Question

I am building a system where I would like to send an encrypted message from AWS Lambda (via an AWS IoT Core rule) to a device. Ideally I would like to encrypt this message using the device's public key (stored within AWS IoT Core); however, I cannot find any documentation on how to retrieve the certificate used to authenticate the device nor it's public key using the AWS SDk (for any language). I'm curious if anyone has been able to achieve something similar.

I am partially modelling my solution after iRobot's solution presented at re:Invent 2016: (video). I assume that it is possible in some way otherwise I'm not sure how the presenter would have accomplished this.

It's also possible that there is a better approach in more recent iterations of AWS IoT Core, so I'm open to suggestions on different ways to approach this issue.

Answer 1

It turns out that the way to this is to first get a list of all principals for a thing (which may or may not include a certificate) using the ListThingPrincipals functionality of the API which returns an array of principals by ARN. If you want exclusively certificates, you can look for principals where the Resource ID of the ARN is cert/*. You can then use the DescribeCertificate endpoint to retrieve information about the certificate including certificatePem which can then be used to derive the public key for the Thing.

Another way to get the certificate ID that was explicitly used to connect to AWS IoT, is to use the principal function in a Rule, which (if a certificate was used to connect) will contain the certificate ID which can then be fed to DescribeCertificate to get the public certificate.