TerraformPilot

DevOps

Terraform for ThreadX and Azure RTOS Devices on Azure IoT Hub

Provision Azure IoT Hub for ThreadX / Azure RTOS (now Eclipse ThreadX) devices with Terraform: IoT Hub, DPS, Device Update for IoT Hub.

LLuca Berton1 min read

ThreadX (the former Microsoft Azure RTOS, now Eclipse ThreadX) ships in billions of MCUs. Devices typically connect to Azure IoT Hub with the Device Provisioning Service (DPS) for zero-touch onboarding and Device Update for IoT Hub for OTA. Terraform's azurerm provider covers all of it.

IoT Hub + DPS

# 
resource "azurerm_iothub" "this" {
  name                = "threadx-hub"
  resource_group_name = azurerm_resource_group.iot.name
  location            = azurerm_resource_group.iot.location
 
  sku {
    name     = "S1"
    capacity = 1
  }
}
 
resource "azurerm_iothub_dps" "this" {
  name                = "threadx-dps"
  resource_group_name = azurerm_resource_group.iot.name
  location            = azurerm_resource_group.iot.location
 
  sku {
    name     = "S1"
    capacity = 1
  }
 
  linked_hub {
    connection_string = azurerm_iothub_shared_access_policy.dps_link.primary_connection_string
    location          = azurerm_resource_group.iot.location
  }
}

Device Update for IoT Hub

# 
resource "azurerm_iothub_device_update_account" "this" {
  name                = "threadx-du"
  resource_group_name = azurerm_resource_group.iot.name
  location            = azurerm_resource_group.iot.location
  sku                 = "Standard"
 
  identity { type = "SystemAssigned" }
}
 
resource "azurerm_iothub_device_update_instance" "this" {
  name              = "production"
  device_update_account_id = azurerm_iothub_device_update_account.this.id
 
  iothub_id = azurerm_iothub.this.id
 
  diagnostic_enabled        = true
  diagnostic_storage_account {
    connection_string = azurerm_storage_account.diag.primary_connection_string
    id                = azurerm_storage_account.diag.id
  }
}

Best Practices

#
  • DPS X.509 enrollment groups — never share symmetric keys at scale.
  • Device twin schemas in source control — they are your contract.
  • Use Device Update import manifests — they handle SHA-256 verification and slot config.
  • Region-pin for data residency.
#
#Terraform#ThreadX#Azure RTOS#Eclipse ThreadX#Azure IoT Hub

Share this article

Related articles