En utilisant AWS re:Post, vous acceptez les AWS re:Post Conditions d’utilisation
AWS re:Postre:Post

Is there a way to authorize GGv2 core devices to interact with AWS services at the Thing Group level ?

0

I understand how attaching policies to the GreengrassV2TokenExchangeRole enables code running on your GG core devices to access AWS services by using the device cert to obtain temporary credentials. The token exchange role is associated with the device in that case. Is there a way to do something similar at the group level so that putting a device in a thing group would give it permission to access particular AWS services and resources ?

Sujets
Internet des objets (IoT)
Balises
AWS IoT GreengrassAWS IoT Core
Langue
English
williamrmay
demandé il y a 2 ans318 vues
1 réponse
1
Réponse acceptée

Hello,

I'm sorry to say that no, there is no way to assign a role for Greengrass to use at a Thing Group level. The individual things will all need their own permission to assume the role. The permission to assume the role could be stored in one IoT Policy which is then attached to each Thing's certificate; that way at least you don't need to duplicate policies.

AWS
EXPERT
MichaelDombrowski-AWS
répondu il y a 2 ans
  • williamrmay
    il y a 2 ans

    Thank you. I guess one could emulate this by having one token exchange role per group and specifying the "group role" during the device install.

  • MichaelDombrowski-AWS EXPERT
    il y a 2 ans

    Yes, if you have thing groups with unique access requirements, then you can have different roles for each. Note that you are limited to 100 IoT Role Aliases per region, so you can only do that with 100 groups.

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions

Contenus pertinents