Problem

IoT sensors in edge environments — remote sites, rural infrastructure, field deployments — cannot rely on continuous cloud connectivity. Standard pipelines that drop data during outages or miss anomalies between sync intervals are not safe for industrial or agricultural telemetry.

• Connectivity loss at the edge means lost sensor readings unless the pipeline buffers locally.
• Batch-sync approaches delay anomaly detection until the next cloud push — too slow for thermal, pressure, or safety events.
• Most IoT tutorials assume a stable connection and skip the resilience layer entirely.

Solution

A fully async Python agent that decouples local processing from cloud sync. Every reading is buffered in SQLite immediately, Claude analyzes the rolling window in real time, and cloud sync is a background task that replays the buffer in order when connectivity returns.

• SQLite offline buffer: every MQTT reading is written locally first — cloud sync never blocks data capture.
• Rolling window anomaly detection: Claude Sonnet 4.6 analyzes the last N readings on every message, not just on sync.
• Async reconnect loop: cloud sync runs as a background coroutine, replaying buffered readings to AWS IoT Core in order on reconnect.
• Terraform-provisioned device identity: AWS IoT Core Thing with X.509 certificate and scoped policy — no shared credentials.

Security Design

• Device identity via X.509: each edge device authenticates to AWS IoT Core with a unique certificate provisioned by Terraform — no shared credentials, no API keys on edge hardware.
• Scoped IoT policy: the Terraform-provisioned IoT policy permits publish to the device's specific topic prefix only — no wildcard permissions, no subscribe access.
• No credentials at rest on edge nodes: the device certificate is the only credential; the Anthropic API key for anomaly detection runs server-side, never on the edge device.
• SQLite integrity: readings are written to SQLite before any network operation — if the process crashes mid-sync, no data is lost and no reading is double-counted on reconnect.
• Terraform-managed lifecycle: all AWS resources (IoT Thing, certificate, policy, attachment) are provisioned and destroyed together — no orphaned credentials or dangling permissions after teardown.

Observability & Operations

Claude anomaly detection runs on every reading — the AI output is the observability layer for the sensor stream. Each analysis returns severity, diagnosis, and recommended action. For production, pipe the structured Claude output to CloudWatch Logs for trend analysis and alerting on high-severity events.

Outcome

End-to-end pipeline proven locally: offline buffer held 10 readings during a simulated outage, Claude detected a high-severity thermal event with a specific diagnosis and remediation recommendation, and the full sync to AWS IoT Core is wired and validated.

• Offline buffer proven: 10 readings held in SQLite during simulated outage, synced in order on reconnect.
• Claude anomaly detection proven: 28°C → 60°C thermal escalation across 5 readings flagged as high severity with diagnosis and remediation step.
• AWS IoT Core sync: MQTT-over-TLS connection wired, Terraform ready — cloud proof pending final apply.
• Total spend: ~$0.05 — Terraform state and IoT Core message costs only.