MQTT communication for GG V2 between Native and Lambda component

0

Good evening everyone 👋,

I have a question that has been bugging me for a couple of hours at this point.

I'm trying to set up a local MQTT communication between a Lambda and a Native component. However, I keep running into authorization issues when I try to publish a message from the Lambda function.

I realized that in for Native components, such authorizations can be granted through accessControl parameters in the configuration of the component, such as:

"ComponentConfiguration": {
        "DefaultConfiguration": {
            "accessControl": {
                "aws.greengrass.ipc.mqttproxy": {
                    "com.iotcommunication:mqttproxy:1": {
                        "policyDescription": "Allow IoT Core MQTT communication to component",
                        "operations": [
                            "aws.greengrass#SubscribeToIoTCore"
                        ],
                        "resources": [
                            "thesis/start"
                        ]
                    }
                },
                "aws.greengrass.ipc.pubsub": {
                    "com.localcommunication:pubsub:1": {
                        "policyDescription": "Allows Local MQTT communication to component",
                        "operations": [
                            "aws.greengrass#PublishToTopic",
                            "aws.greengrass#SubscribeToTopic"
                        ],
                        "resources": [
                            "*"
                        ]
                    }
                }
            }
        }
    },

However, this is not the case in a Lambda function component, where only Event Sources can be configured. These sources are just there for subscribing to topics, but not for publishing.

"componentLambdaParameters": {
  "eventSources": [
        {
           "topic": "local/nocontainer/nopinned",
           "type": "PUB_SUB"
        }
   ],
}

Therefore, when a message is published by the Lambda function to the topic, the following error is given in the execution:

2023-11-02T15:51:44.247Z [ERROR] (pool-2-thread-62) lambda_nocontainer_nopinned: lambda_function.py:118,Unauthorized error while publishing to topic: thesis/gateway. {serviceInstance=1, serviceName=lambda_nocontainer_nopinned, currentState=RUNNING}

I'm assuming that this error is given due to insufficient access control. So my question is, how do I make this setup work where my Lambda function can just publish messages to a Local MQTT topic.

I appreciate it a lot 🙏

Ed
preguntada hace 6 meses187 visualizaciones
1 Respuesta
2

Hi Ed. With the Lambda component, the recipe is generated, so you can't set access control through the default configuration of the recipe. However, you can still update the Lambda component configuration by merging configuration in a deployment: https://docs.aws.amazon.com/greengrass/v2/developerguide/update-component-configurations.html#merge-configuration-update. You can use the local Greengrass CLI to verify that the configuration has successfully merged: https://docs.aws.amazon.com/greengrass/v2/developerguide/gg-cli-component.html#component-details

More details in these two previous answers:

profile pictureAWS
EXPERTO
Greg_B
respondido hace 6 meses
AWS
EXPERTO
revisado hace 6 meses

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas