# SiteWise Edge / OPC-UA Gateway Checklist (July 2026)

Use before production sign-off on a self-hosted SiteWise Edge gateway (Greengrass v2).

## Gateway type

- [ ] Prefer **MQTT-enabled, V3** for new self-hosted gateways (path filters + destinations).
- [ ] Use **Classic streams, V2** only if you already depend on the Data Processing Pack (DPP) — DPP is closed to new customers (maintenance as of 2025-11-07).
- [ ] Do not plan new edge transforms/metrics on DPP; compute in cloud SiteWise or Flink/Lambda.

## Components (correct names)

- [ ] `aws.iot.SiteWiseEdgeCollectorOpcua` RUNNING
- [ ] `aws.iot.SiteWiseEdgePublisher` RUNNING
- [ ] Nucleus on a supported 2.16+ line (TPM) / 2.17+ (non-root) / verify latest 2.18.x in target region

## OPC-UA security

- [ ] Message security: **Sign & Encrypt** (not None) in production
- [ ] Policy: Basic256Sha256 or stronger
- [ ] Auth: username/password via Secrets Manager or X.509 — not anonymous
- [ ] Node filters scoped to required tags only (cost + CPU)

## Ops / resilience

- [ ] Local buffer sized for ≥48h expected outage at peak scan rate
- [ ] CloudWatch alarms: collector status, publisher backlog, OPC-UA disconnects
- [ ] Deployment failure policy: ROLLBACK; stage → pilot → full
- [ ] Dashboards: Amazon Managed Grafana (SiteWise Monitor closed to new customers)

## References

- [OPC UA sources](https://docs.aws.amazon.com/iot-sitewise/latest/userguide/configure-sources-opcua.html)
- [MQTT-enabled V3 gateways](https://docs.aws.amazon.com/iot-sitewise/latest/userguide/mqtt-enabled-v3-gateway.html)
- [Collector component](https://docs.aws.amazon.com/greengrass/v2/developerguide/iotsitewise-opcua-collector-component.html)