Is there a way to authorize GGv2 core devices to interact with AWS services at the Thing Group level ?

Question

I understand how attaching policies to the GreengrassV2TokenExchangeRole enables code running on your GG core devices to access AWS services by using the device  cert to obtain temporary credentials. The token exchange role is associated with the device in that case.  Is there a way to do something similar at the group level so that putting a device in a thing group would give it permission to access particular AWS services and resources ?

MichaelDombrowski-AWS · Accepted Answer

Hello,

I'm sorry to say that no, there is no way to assign a role for Greengrass to use at a Thing Group level. The individual things will all need their own permission to assume the role. The permission to assume the role could be stored in one IoT Policy which is then attached to each Thing's certificate; that way at least you don't need to duplicate policies.

Is there a way to authorize GGv2 core devices to interact with AWS services at the Thing Group level ?

Relevant content