There are any number of requests to integrate directly with the AWS API Gateway. I am in the midst of battle with the wolfssl library. You can find any number of library references.
There is a separate AWS API integration post which is good. This particular post shows how to hit the API to send data/message to the Photon. This particular effort is to push data from the Photon to AWS API (and into AWS Lambda). Don’t even think about getting directly to AWS Lambda. That is protected by the AWS IAM. In order to talk to AWS Lambda directly, you need to authenticate via Signature Version 4 methods. Once you do that, you can then do a direct call to AWS Lambda. By then, you will probably has spent out your 1MB allocation. 
It turns out access to the AWS API gateway for pushing information into is not so easy. I am at the point where I have to dig down into the source code and do some byte-wise comparisons of network traffic to get this to work. The tools are:
The first thing to do is get a good representative example that works. This can be done quick and dirty on the command line using curl and supply the correct certs and arguments. Beyond that, actually testing the client is the next best thing to be sure the library can actually connect and do the TLS handshake.
Using a fairly stripped down library, I can get it to work with the AWS IoT service. However, the AWS API service is using more modern encryption methods which may prove too costly to implement.
Using curl, we find two interesting facts.
Fact #1
SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
According to the armMBED documentation, curl is using “RSA with Elliptic Curve Ephemeral Diffie Hellman (ECDHE-RSA) key exchange”.
Memory increase #1: Elliptical curve code needs to be turned on.
Fact #2
AWS API is using ALPN (Application Layer Protocol Negotiation). This is the slow march from HTTP/1.1 to HTTP/2 (aka h2). There are some good things that may come of this (read: What’s the Big Deal?).
Memory increase #2: ALPN has to be turned on and it also seems like SNI (Server Name Indication) also needs to be turned on.
I don’t know what else needs to happen, but between the two, I am now up against the 120k barrier with DEBUG code turned on. I am going to have to turn off debugging and error messages to keep the code small enough to get around some stack/heap errors that cause the Particle to panic and reset.
I figured I should write about this discovery as services move forward and upgrade software stacks. If things start breaking, this should give you an idea of where to begin looking.
wolfssl status
Curl
It turns out there are various components of several TLS libraries within curl which is probably why it works so well. It works better under Linux than MacOS. MacOS can’t seem to keep up with the pace of openssl. So, don’t do advanced testing under MacOS unless you’ve updated it via brew, etc. I personally use VirtualBox with a Linux VM on top of MacOS.
WolfSSL client
It also works under Linux. The relevant part of the debug output is this:
wolfSSL Entering SSL_new
wolfSSL Leaving SSL_new, return 0
ALPN accepted protocols list : h2
wolfSSL Entering wolfSSL_UseALPN
wolfSSL Entering TLSX_ALPN_New
In Particle, I’ve turned on ALPN and turned on the ECC curves. I can’t get the device to swing over into HTTP/2. Further down in the output, it does say it reached a match with ALPN, but I am still suffering from red light resets. Again, we may be hitting the limits on the firmware size.
Memory use:
text data bss dec hex filename
125140 216 2308 127664 1f2b0 /workspace/target/workspace.elf
Particle
wolfSSL Entering wolfSSL_CTX_set_verify
SNI is set.
Connected to gtem4845hl.execute-api.us-west-2.amazonaws.com
wolfSSL Entering SSL_new
wolfSSL Leaving SSL_new, return 0
SSL version is wolfSSL Entering SSL_get_version
TLSv1.2
wolfSSL Entering wolfSSL_UseALPN
wolfSSL Entering TLSX_ALPN_New
wolfSSL Entering TLSX_ALPN_New
ALPN settings were accepted.
No protocol match with peer -> Continue
ALPN_GetProtocol(-9)
Header size: 191
wolfSSL Entering SSL_write()
handshake not complete, trying to finish
wolfSSL Entering wolfSSL_negotiate
wolfSSL Entering SSL_connect()
Growing output buffer
Shrinking output buffer
connect state: CLIENT_HELLO_SENT
Growing input buffer
received record layer msg
wolfSSL Entering DoHandShakeMsg()
wolfSSL Entering DoHandShakeMsgType
processing server hello
SNI extension received
ALPN extension received
ALPN protocol match
wolfSSL Entering TLSX_ALPN_New
My fallback might be to take another look at axtls and mbedTLS.
