Resource defined in recipe seems cached when MQTT publish to IoT Core

0

I am new to Greengrass, so this question might be obvious to some people. I create a simple module publish to topic "my/test" to IoTCore. Everything seems to be working okay. Then I changed the topic to "mytopic/test" both in my code and recipe. I thought it should just work, but I get:

2021-03-03T17:14:40.789Z [INFO] (Thread-5) com.aws.greengrass.builtin.services.mqttproxy.MqttProxyIPCAgent: Not Authorized. {error=Principal com.example.PubSub is not authorized to perform aws.greengrass.ipc.mqttproxy:aws.greengrass#PublishToIoTCore on resource mytopic/test}

My recipe looks like this:

{
    "RecipeFormatVersion": "2020-01-25",
    "ComponentName": "com.example.PubSub",
    "ComponentVersion": "1.0.0",
    "ComponentDescription": "My test AWS IoT Greengrass component.",
    "ComponentPublisher": "3S",
    "ComponentConfiguration": {
      "DefaultConfiguration": {
        "accessControl": {
          "aws.greengrass.ipc.mqttproxy": {
            "com.example.PubSub:pubsub:1": {
              "policyDescription":"Allows access to publish to my topic",
              "operations" : [
                "aws.greengrass#PublishToIoTCore",
                "aws.greengrass#SubscribeToIoTCore"
              ],
              "resources": [
                "mytopic/test"
              ]
            }
          }
        },
        "Message": "whatever"
      }
    },
    "Manifests": [
      {
        "Platform": {
          "os": "linux"
        },
        "Lifecycle": {
          "Run": "python3 {artifacts:path}/my_pubsub.py '{configuration:/Message}'"
        }
      }
    ]
  }

Even when I change resource to "*", I still get the same authorization error. However, if I change my code back to publish on the original topic "my/test", it works as before as if the resource defined in the recipe had no effect. Thanks in advance.

jcai
asked 3 years ago421 views
9 Answers
0

Hello,
The problem that you are having is because you have changed the DefaultConfiguration. As the name says, these are only defaults and if you have any configuration already then they will not be used. The way to address this is to update your deployment to RESET the configuration for this component back to the defaults (which will be the new default value). See our documentation of reset here: https://docs.aws.amazon.com/greengrass/v2/developerguide/update-component-configurations.html#reset-configuration-update.

If you're using the console, then on the third page of revising the deployment you will see a table of all the components you will be deploying with radio buttons on the left side. Select the radio button for your component and then click the button to configure it. There will be 2 sections for MERGE and RESET. You can either use MERGE to update the configuration to a new value, or use RESET to reset it to the defaults which are provided in your recipe. I'd suggest putting this into the RESET box:

[""]

This will reset all configuration values back to the defaults.

Hope that helps,
Michael Dombrowski

AWS
EXPERT
answered 3 years ago
0

Thank you Michael for your reply. I have couple of follow up questions.

  1. How many configurations can I specify in the recipe file? All the examples I see only have DefaultConfiguration defined.
  2. If I define my own configuration in the recipe, does it mean every time I change the recipe, I should deploy with "--update-config" option?
  3. My component is only deployed locally, I use "greengrass-cli deployment create" to deploy it. I don't see how I can reset configuration in console. How do I do that with greengrass-cli?

Thanks much!

jcai
answered 3 years ago
0
  1. Recipes only define their default configurations. To provide different configurations you use MERGE in a deployment.
  2. Answered in 1
  3. Reset configuration using greengrass-cli deployment create --merge <your component>=<version> --update-config '{"componentName": {"MERGE": {"<key>": "<value>"}, "RESET": ["</path/to/reset>"]}}'
AWS
EXPERT
answered 3 years ago
0

I tried to use the command to reset my component, but it does not seem to work.
I created reset.json file with the following content:

{"componentName": { 
  "RESET":[""] 
  } 
}

Then I called
$ sudo greengrass-cli deployment create --recipeDir ~/GreengrassCore/recipes --artifactDir ~/GreengrassCore/artifacts --merge "com.example.PubSub=1.0.0" --update-config reset.json

It was deployed successful, but it did not reset the default configuration. When I run "greengrass-cli component details --name=com.example.PubSub", it still shows the configuration that was in the recipe. I was expecting it to be empty. What am I missing here? Thanks!

jcai
answered 3 years ago
0

If it is showing you what is in the recipe, then that is precisely what it is supposed to do. Reset resets any existing configuration to the default values defined in the recipe. You can use MERGE to update the configuration to have something different.

AWS
EXPERT
answered 3 years ago
0

I thought I understood, but it is not doing what I expect. I removed resources from my recipe. Then I used reset.json in my deployment. In my recipe, the configuration looks like:

      "DefaultConfiguration": {
        "accessControl": {
          "aws.greengrass.ipc.mqttproxy": {
            "com.example.PubSub:pubsub:1": {
              "policyDescription":"Allows access to publish to my/topic",
              "operations" : [
                "aws.greengrass#PublishToIoTCore",
                "aws.greengrass#SubscribeToIoTCore"
              ],
              "resources": [          <=== see, empty
              ]
            }
          }
        },
        "Message": "whatever"
      }

My reset.json is still just

{"componentName": { 
  "RESET":[""] 
  } 
}

I deployed with "--update-config reset.json" and after that when I check component details, it still shows

Configuration: {"accessControl":{"aws.greengrass.ipc.mqttproxy":{"com.example.PubSub:pubsub:1":{"operations":["aws.greengrass#PublishToIoTCore","aws.greengrass#SubscribeToIoTCore"],"policyDescription":"Allows access to publish to my/topic","resources":["my/topic"]}},"aws.greengrass.ipc.pubsub":{"com.example.PubSub:pubsub:1":{"operations":["aws.greengrass#PublishToTopic"],"policyDescription":"Allows access to publish to my/topic","resources":["my/topic"]}}},"Message":"whatever"}

The resources were never reset to default. I am still not getting it.

jcai
answered 3 years ago
0

"ComponentName" is supposed to be replace with your component's name, "com.example.PubSub".

So you should have

{"com.example.PubSub": {"RESET": [""]}}
AWS
EXPERT
answered 3 years ago
0

Yes, of course. It is working now.
Thank you so much!

jcai
answered 3 years ago
0

Great, glad to hear that worked for you.

AWS
EXPERT
answered 3 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions