AWS IoT Greengrass (V2) Core Device - Management

Question

Hello,

I have a couple of questions related to selecting the right tool for the job. 
There are three different technologies, which apparently all of them can handle device management:

1. AWS Systems Manager Agent component - the standard edition is limited to 1,000 devices (per account and per region). My understanding is that it would allow me to use the regular system manager capabilities, e.g., patching, automation, session manager (remote shell access), etc.
2. AWS IoT Device Management - there are some unique capabilities but similar to AWS Systems Manager it enables Device Jobs (that can be used to support software updates), Secure Tunneling (remote access), etc.
3. AWS Greengrass V2 Deployments (Create deployments) - appear to allow updating Greengrass software via jobs.

I prefer to use just the tools I really need. Can you please advise what is the different between the three approach specifically for managing (patch/updates) Greengrass (V2) Core devices? is the 3rd option (AWS Greengrass V2 Deployments) sufficient for patch/updates in this particular use case?

Thank you

Greg_B · Accepted Answer

Hi yossico. Greengrass V2 deployments are purpose built for managing and updating your Greengrass v2 components, including the Nucleus itself. This is the best way to manage your components.

However, Greengrass deployments don't natively support updating or managing the underlying OS of your core device. This is where the [Systems Manager Agent](https://docs.aws.amazon.com/greengrass/v2/developerguide/manage-with-systems-manager.html) can be a powerful addition, allowing you to orchestrate OS patch management across your fleet. In particular the [Node Management](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-instances-and-nodes.html) features such as [Patch Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html), [Run Command](https://docs.aws.amazon.com/systems-manager/latest/userguide/execute-remote-commands.html), [Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) and [Fleet Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-instances-and-nodes.html). This video may be of interest: https://www.youtube.com/watch?v=CqzSBkp5Vi0

Deployments do indeed use AWS IoT Jobs, but deployments are a specialized kind of job. You can build a component that uses AWS IoT Jobs for other purposes. However, Greengrass V2 does not have any generalized support for jobs out of the box.

[Secure Tunneling](https://docs.aws.amazon.com/iot/latest/developerguide/secure-tunneling.html) is a great tool for remote access, but what it gives you is quite similar to [Systems Manager Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html), so you may not need or want both. You are only charged when you open a tunnel however, so you can install the [Secure tunneling component](https://docs.aws.amazon.com/greengrass/v2/developerguide/secure-tunneling-component.html) and only use it if/when you need it.

AWS IoT Greengrass (V2) Core Device - Management

Relevant content