slug: amazon-iot-device-management provider: Amazon IoT Device Management generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Automotive & Mobility min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 18 edges: - tag: Principal Policies spec_file: amazon-iot-device-management-principal-policies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.82 evidence: PUT /principal-policies/{policyName}#x-amzn-iot-principal AttachPrincipalPolicy ... DetachPrincipalPolicy reason: Grants and revokes authorisation policies for principals (device identities) — core identity & access management. - tag: Authorizer spec_file: amazon-iot-device-management-authorizer-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: POST /authorizer/{authorizerName} CreateAuthorizer; POST /authorizer/{authorizerName}/test TestInvokeAuthorizer; schemas MqttUsername, MqttPassword, PrincipalId, PolicyDocument, AuthorizerStatus reason: Custom authorizers authenticate and authorise connecting devices/clients, producing principal identities and policy documents — plainly identity and access management for the platform. - tag: Policies spec_file: amazon-iot-device-management-policies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: POST /policies/{policyName} CreatePolicy ... SetDefaultPolicyVersion; schema PolicyDocument reason: IoT authorisation policy documents and versions governing device permissions — access management, not corporate Policy Management. - tag: Role Aliases spec_file: amazon-iot-device-management-role-aliases-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: CreateRoleAlias; schemas RoleArn, CredentialDurationSeconds reason: Role aliases let devices assume IAM roles for temporary credentials — clearly identity and access management. recovered_from: sweep-20260828T235257Z-edges.json - tag: Principal Policies#x Amzn Iot Principal spec_file: amazon-iot-device-management-principal-policies-x-amzn-iot-principal-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: GET /principal-policies#x-amzn-iot-principal ListPrincipalPolicies reason: Lists the authorisation policies attached to a principal — access-rights inspection, an IAM function. - tag: Attached Policies spec_file: amazon-iot-device-management-attached-policies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: POST /attached-policies/{target} ListAttachedPolicies; schemas PolicyArn, PolicyName, Policies, PolicyDocument-style Policy reason: Lists authorisation policies attached to a principal/target — access control policy administration, i.e. identity and access management. Not corporate Policy Management (BC-130.20), which concerns written company policies. - tag: Authorizers spec_file: amazon-iot-device-management-authorizers-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: GET /authorizers/ ListAuthorizers; schemas AuthorizerSummary, AuthorizerArn, AuthorizerName reason: Listing of custom authorizers used to authenticate device connections — same identity and access management surface as the Authorizer tag, though the single list operation is thin. - tag: Cacertificate spec_file: amazon-iot-device-management-cacertificate-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: POST /cacertificate RegisterCACertificate; schemas CertificatePem, AutoRegistrationStatus, CACertificateStatus, CertificateValidity reason: Registration and lifecycle of CA certificates used to authenticate and auto-register devices — PKI credential administration, i.e. identity and access management for the IoT platform. - tag: Keys And Certificate spec_file: amazon-iot-device-management-keys-and-certificate-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: POST /keys-and-certificate CreateKeysAndCertificate; schemas KeyPair, CertificatePem, PrivateKey, PublicKey reason: Issues X.509 key pairs and certificates used to authenticate devices — credential issuance, i.e. identity & access management, not a domain business capability. - tag: Policy Principals#x Amzn Iot Policy spec_file: amazon-iot-device-management-policy-principals-x-amzn-iot-policy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: GET /policy-principals#x-amzn-iot-policy ListPolicyPrincipals; schemas Principals, PrincipalArn reason: Lists principals to which an authorisation policy is attached — access-rights administration. - tag: Policy Targets spec_file: amazon-iot-device-management-policy-targets-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: POST /policy-targets/{policyName} ListTargetsForPolicy; schemas PolicyTarget, PolicyTargets reason: Enumerates identities/targets bound to an access policy — authorisation administration surface. - tag: Accept Certificate Transfer spec_file: amazon-iot-device-management-accept-certificate-transfer-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: PATCH /accept-certificate-transfer/{certificateId} AcceptCertificateTransfer; TransferAlreadyCompletedException reason: Accepting transfer of a device X.509 certificate is credential/identity administration for authenticating devices, i.e. identity and access management within a cloud IoT platform. Not an automotive-specific capability — the vendor is a device management devtool. - tag: Active Violations spec_file: amazon-iot-device-management-active-violations-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: GET /active-violations ListActiveViolations; schemas ActiveViolation, BehaviorMetric, SecurityProfile-style MachineLearningDetectionConfig, ViolationEventAdditionalInfo reason: Device Defender security-profile violations — detection of anomalous/non-conforming device behaviour and its violation events, which is threat detection and response tooling, not financial-crime or compliance alerting. - tag: Certificates spec_file: amazon-iot-device-management-certificates-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: 'POST /certificates CreateCertificateFromCsr; PUT /certificates/{certificateId}#newStatus UpdateCertificate; schemas: CertificateStatus, CertificateValidity, CertificateDescription' reason: Full lifecycle of device certificates — create from CSR, list, describe, activate/revoke via status update. Clearly credential/PKI administration for device authentication, mapped to identity & access management. recovered_from: sweep-20260828T235257Z-edges.json - tag: Default Authorizer spec_file: amazon-iot-device-management-default-authorizer-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: 'POST /default-authorizer SetDefaultAuthorizer ... schemas: AuthorizerDescription, AuthorizerFunctionArn, TokenKeyName, AuthorizerStatus' reason: Setting, describing and clearing the default custom authorizer configures how devices are authenticated/authorised against the platform — identity and access management for the technology estate. recovered_from: sweep-20260828T235257Z-edges.json - tag: Effective Policies spec_file: amazon-iot-device-management-effective-policies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: 'POST /effective-policies GetEffectivePolicies ... schemas: EffectivePolicy, PolicyDocument, PolicyArn' reason: Resolving the effective authorisation policies attached to a device/principal is access-permission evaluation — identity and access management. recovered_from: sweep-20260828T235257Z-edges.json - tag: Reject Certificate Transfer spec_file: amazon-iot-device-management-reject-certificate-transfer-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: PATCH /reject-certificate-transfer/{certificateId} RejectCertificateTransfer reason: Certificate lifecycle operation on device credentials — identity/credential administration, not a business transfer. recovered_from: sweep-20260828T235257Z-edges.json - tag: Test Authorization spec_file: amazon-iot-device-management-test-authorization-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /test-authorization TestAuthorization; schemas AuthDecision, Allowed, Denied, ImplicitDeny, AuthResult reason: Evaluates whether device/identity policies permit an action — authorization policy evaluation, squarely identity and access management rather than any industry business capability. recovered_from: sweep-20260828T235257Z-edges.json