Manufacturing Industrial IoT on AWS (2026): OPC-UA, SiteWise, and OEE Reference Architecture

AWS IoT SiteWise shipped native multivariate anomaly detection in July 2025 (AWS announcement) — up to 300 sensors per model, available in US East (N. Virginia), Europe (Ireland), and Asia Pacific (Sydney). September 2025 updates added automated model retraining (30-day to 1-year schedules) and manual vs automatic model promotion (What’s New). IoT Greengrass v2 remains the standard edge host for SiteWise Gateway OPC-UA collectors (Edge to Twin blog pattern).

This post is the manufacturing industrial IoT reference architecture — plant floor to OEE dashboard. It is not logistics / supply chain, not generic IoT patterns, not consumer connected devices alone, and not a TwinMaker product tour — though TwinMaker appears in tier 3.

Artifacts: architecture decision matrix, OEE KPI baseline CSV.

Benchmark pattern (not a cited client) — Discrete manufacturing, ~850 OPC-UA tags, 12 production lines, legacy MES (batch export), OEE 61%, unplanned downtime 11.2% of scheduled hours. Phase 1: Greengrass + SiteWise Gateway on 4 lines (ingest latency 8 min → 45 sec). Phase 2: SiteWise anomaly detection on 6 rotating assets (OEE 61% → 74% in 90 days; unplanned downtime −18%). MES unchanged.

Three tiers — plant floor to boardroom

Opinionated take: Fix tag taxonomy before TwinMaker. Teams that buy 3D twins before OEE baselines rebuild dashboards twice.

Reference architecture

PLC / OPC-UA ──► Greengrass + SiteWise Gateway ──► IoT SiteWise (cloud)
                              │                           │
                              │                           ├── Asset models / OEE metrics
                              │                           ├── Anomaly detection (multivariate)
                              │                           └── Export → S3
                              │
MES (batch) ──► S3 landing ──► Glue (optional) ──► QuickSight dashboards
                              │
                              └──► EventBridge ──► Lambda (maintenance tickets)

Edge layer — Greengrass + OPC-UA

Deploy SiteWise Gateway as a Greengrass v2 component per line or cell:

• Buffer telemetry during WAN blips (store-and-forward)
• Keep OPC-UA traffic off corporate IT VLAN — DMZ pattern per OT/IT convergence
• Certificate lifecycle is the #1 ops task — alarm 30 days before expiry

Cloud layer — SiteWise

• Model assets to match physical hierarchy (plant → line → machine → sensor)
• Map OPC-UA nodes in oee-kpi-baseline.csv
• Enable disassociated data ingestion if streams appear missing after gateway sync (SiteWise settings)

Anomaly detection — when it earns ROI

Per SiteWise pricing:

• Training: minimum 1 hour billed, prorated per minute
• Up to 300 sensors per model
• High-frequency inference (5–60 min schedules) vs low-frequency count-based options

Target rotating equipment (motors, pumps, compressors) with continuous signals — not discrete reject counts alone.

What broke — Week 6 pilot. 3 lines showed flat OEE while operators reported running status. Root cause: OPC-UA client certs expired on two Greengrass cores; third line had wrong namespace prefix. Detection: SiteWise LastUpdateTime alarm. Fix: cert rotation runbook + standardized ns=2;s= prefix in tag catalog. OEE dashboards recovered within 4 hours of cert redeploy.

OEE — measure before models

Baseline every tag in oee-kpi-baseline.csv before enabling anomaly models.

When NOT to escalate

What to Do This Week

1. Export OPC-UA tag list — fill oee-kpi-baseline.csv.
2. Run decision matrix — SiteWise vs custom lake.
3. Pilot one line with Greengrass + SiteWise Gateway before plant-wide rollout.
4. Set cert expiry alarms on every gateway core.
5. Defer TwinMaker until QuickSight OEE dashboard has weekly active users.

Reproduce this — Download oee-kpi-baseline.csv. Mark anomaly_model_eligible=yes only for assets with ≥30 days continuous history. Walk architecture-decision-matrix.md section 4 before enabling SiteWise training.

What This Post Doesn’t Cover

• Warehouse / WMS / TMS logistics — logistics reference architecture
• Full MES replacement — vendor domain
• Robotics / AMR fleet — separate integration patterns
• HIPAA / FDA validation — healthcare digital health reference architecture (2026) and healthcare hub for regulated subsectors

We have not benchmarked SiteWise anomaly training cost for every asset class — run a one-line pilot and read billed training hours before plant-wide model rollout.

Related: Manufacturing industry hub · Data analytics services · Managed services

Frequently asked questions

When should we use IoT SiteWise vs a custom S3 data lake for manufacturing telemetry?

Use SiteWise when you need asset hierarchy, OEE calculations, and native anomaly detection across hundreds of tags with operational models. Build IoT Core → S3 → Athena when you have under ~100 tags, one line, and batch reporting suffices — SiteWise model overhead is not justified.

When should we NOT deploy IoT TwinMaker on day one?

Skip TwinMaker until OEE baselines exist and stakeholders consume QuickSight dashboards. TwinMaker adds 3D workspace and entity modeling cost without fixing bad tag naming or missing edge buffering.

What breaks when OPC-UA certificates expire at scale?

Greengrass gateways stop ingest silently while cloud dashboards show stale last-known values. Symptom: OEE flatlines on multiple lines simultaneously. Fix: cert expiry alarms 30 days ahead, automated rotation runbook, spare gateway config in S3.

How does this differ from logistics supply chain architecture?

Logistics focuses on shipment movement, TMS/telematics, and OTIF. Manufacturing focuses on plant-floor OPC-UA, OEE, and predictive maintenance on rotating equipment — different KPIs and edge patterns.

When should we NOT enable SiteWise anomaly detection?

Skip when you have less than ~30 days of clean multivariate history, failure modes are discrete events without sensor precursors, or fewer than 20 relevant sensors per asset model — use threshold alarms first.

What could go wrong merging OT and IT networks too early?

Flat VLAN exposes PLCs to IT malware scan traffic; production stops. Mitigate with IEC 62443-aligned segmentation, IoT Greengrass on DMZ, and no inbound from corporate Wi-Fi to OPC-UA ports — see OT/IT convergence post.