By using AWS re:Post, you agree to the Terms of Use
/Is there a way to authorize GGv2 core devices to interact with AWS services at the Thing Group level ?/

Is there a way to authorize GGv2 core devices to interact with AWS services at the Thing Group level ?

0

I understand how attaching policies to the GreengrassV2TokenExchangeRole enables code running on your GG core devices to access AWS services by using the device cert to obtain temporary credentials. The token exchange role is associated with the device in that case. Is there a way to do something similar at the group level so that putting a device in a thing group would give it permission to access particular AWS services and resources ?

1 Answers
1
Accepted Answer

Hello,

I'm sorry to say that no, there is no way to assign a role for Greengrass to use at a Thing Group level. The individual things will all need their own permission to assume the role. The permission to assume the role could be stored in one IoT Policy which is then attached to each Thing's certificate; that way at least you don't need to duplicate policies.

MichaelDombrowski-AWS
answered 2 days ago
  • Thank you. I guess one could emulate this by having one token exchange role per group and specifying the "group role" during the device install.

  • Yes, if you have thing groups with unique access requirements, then you can have different roles for each. Note that you are limited to 100 IoT Role Aliases per region, so you can only do that with 100 groups.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions