Confused about permissions in IOT Core/PubSub/Shadows, Greengrass, IAM roles, service roles and IPC.

There are several different policies and it can be tough to understand what goes where, but understanding the various resource types and their scope can help.

Greengrass components access resources through IPC. IPC resources are local to the Greengrass device. The "principal" accessing those resources is the component itself. You can give components the necessary permissions in the component configuration.

• https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html
• https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-authorization-policies

Some IPC resources map to resources which exist in AWS IoT (e.g. Shadows, MQTT topics). The Greengrass core device is the "principal" which accesses those resources. For those, you need to give Greengrass permission in the IoT Policy which is attached to the Greengrass core certificate. You would configure the IoT Policy for anything your component accesses using the IoT Device SDK.

• https://docs.aws.amazon.com/greengrass/v2/developerguide/device-auth.html
• https://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.html
• https://docs.aws.amazon.com/iot/latest/developerguide/iot-sdks.html

Other times IPC resources map to resources in other parts of AWS (e.g. secrets stored in Secrets Manager). To access those, you would typically need IAM credentials. Greengrass can get IAM credentials using the role alias. You would also configure this policy for anything your component accesses using the regular AWS SDK.

• https://docs.aws.amazon.com/greengrass/v2/developerguide/interact-with-aws-services.html

And finally, you can also connect external client devices to Greengrass. You can configure the Client Devices Auth component in order to define the permissions that client devices have when connecting to the local MQTT broker.

• https://docs.aws.amazon.com/greengrass/v2/developerguide/connect-client-devices.html

You don't need to worry about the service role, for the most part. That gets used by the Greengrass cloud service in a few scenarios when using client devices. You can set it up once (if using client devices) and then forget it exists.