Is there a way to authorize GGv2 core devices to interact with AWS services at the Thing Group level ?

I understand how attaching policies to the GreengrassV2TokenExchangeRole enables code running on your GG core devices to access AWS services by using the device cert to obtain temporary credentials. The token exchange role is associated with the device in that case. Is there a way to do something similar at the group level so that putting a device in a thing group would give it permission to access particular AWS services and resources ?

주제

사물 인터넷(IoT)

태그

AWS IoT Greengrass AWS IoT Core

언어

English

williamrmay

질문됨 2년 전318회 조회

1개 답변

최신
최다 투표
가장 많은 댓글

수락된 답변

Hello,

I'm sorry to say that no, there is no way to assign a role for Greengrass to use at a Thing Group level. The individual things will all need their own permission to assume the role. The permission to assume the role could be stored in one IoT Policy which is then attached to each Thing's certificate; that way at least you don't need to duplicate policies.

전문가

MichaelDombrowski-AWS

답변함 2년 전

williamrmay
2년 전
Thank you. I guess one could emulate this by having one token exchange role per group and specifying the "group role" during the device install.
MichaelDombrowski-AWS 전문가
2년 전
Yes, if you have thing groups with unique access requirements, then you can have different roles for each. Note that you are limited to 100 IoT Role Aliases per region, so you can only do that with 100 groups.

Is there a way to authorize GGv2 core devices to interact with AWS services at the Thing Group level ?

관련 콘텐츠