How to automate the creation of Greengrass Core Device Shadow with fleet provisioning?

Hello again,

I looked into the issue and it seems that device shadow is not the root cause.

FleetStatusService (FSS) is responsible for creating a new core device in cloud. If fleet provisioning is not finished when FSS starts, FSS goes offline during fleet provisioning and is not notified to restart, which fails to create a greengrass core in cloud and leads to the shadow error message you see in cloudwatch.

It is a recently discovered bug of FSS and we are working on a fix. In the meantime, you shouldn't have needed to create the shadow topic manually. Restarting greengrass nucleus alone after provisioning will restart of FSS and create a greengrass core in cloud, which is run the greengrass core software installation again as you mentioned.

Could you confirm that restart nucleus alone can fix your issue? If yes, then it's this known issue we are fixing right now.

Let me know if you have any other questions.

Junfu

Hello,

By default, fleet provisioning does not require creating the shadow manually; classic shadows are created automatically. Could you share with me your configuration of IoT policy and shadow manager to help me reproduce your issue?

You mentioned that you found this error in Cloudwatch log. Could you also share which service is logging this error and some context around this log?

Thanks,

Junfu

You can set up an IoT topic rule that listens to thing events and execute a Lambda function when a thing is created.

Here's an example CloudFormation template with the IoT rule and Lambda function.

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Resources:
  ThingEventRule:
    Type: AWS::IoT::TopicRule
    Properties:
      RuleName: !Sub "ThingEvent"
      TopicRulePayload:
        RuleDisabled: false
        Sql: SELECT * FROM '$aws/events/thing/#'
        Actions:
          - Lambda:
              FunctionArn: !GetAtt ProvisioningFunction.Arn
  ProvisioningFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-provisioning"
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  ProvisioningFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-provisioning"
      Role: !GetAtt ProvisioningFunctionRole.Arn
      Timeout: 5
      Handler: index.handler
      Runtime: python3.9
      MemorySize: 512
      CodeUri: ./thing-event-function
  ProvisioningFunctionPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt ProvisioningFunction.Arn
      Action: lambda:InvokeFunction
      Principal: iot.amazonaws.com
      SourceAccount: !Ref AWS::AccountId
      SourceArn: !GetAtt ThingEventRule.Arn

Here's the code for the Lambda function.

import boto3
import json
import logging


iotdata = boto3.client('iot-data')


def handler(event, context):
    if 'operation' not in event or event['operation'] != 'CREATED':
        logging.warn('Ignoring non CREATED event')
        return

    # Add your properties here
    properties = {}

    # And finally update the thing's shadow
    iotdata.update_thing_shadow(
        thingName=event['thingName'],
        payload=json.dumps({'state': {'desired': properties}})
    )
    logging.info("Wrote shadow to thing")

Make sure to enable thing events in your AWS account as documented here https://docs.aws.amazon.com/iot/latest/developerguide/iot-events.html#iot-events-enable