Lambda component with IPC permissions in Greengrass V2

0

We have migrated a lambda from AWS Greengrass v1 to AWS Greengrass v2. This lambda needs to extract and decrypt a secret from Greengrass Core.

How can we authorize the component to perform IPC permissions to the lambda for that? Regular components recipes have the option ComponentConfiguration/DefaultConfiguration/accessControl. However when we build the component out of a lambda using AWS CLI create-component-version and option --lambda-function, there is no option to assign authorization policies.

One way we tried to make it work is by using a merge update in our deployment (as documented here).

    "accessControl": {
        "aws.greengrass.SecretManager": {
            "<my-component>:secrets:1": {
                "policyDescription": "Credentials for server running on edge.",
                "operations": [
                    "aws.greengrass#GetSecretValue"
                ],
                "resources": [
                    "arn:aws:secretsmanager:us-east-1:<account-id>:secret:xxxxxxxxxx"
                ]
            }
        }
    }

However the end recipe of the component (in the deployment) does not display the accessControl (AWS Greengrass Console), so we assume it has not been merge updated.

...
  "ComponentConfiguration": {
    "DefaultConfiguration": {
      "lambdaExecutionParameters": {
        "EnvironmentVariables": {
          "LOG_LEVEL": "DEBUG"
        }
      },
      "containerParams": {
        "memorySize": 16384,
        "mountROSysfs": false,
        "volumes": {},
        "devices": {}
      },
      "containerMode": "NoContainer",
      "timeoutInSeconds": 30,
      "maxInstancesCount": 10,
      "inputPayloadEncodingType": "json",
      "maxQueueSize": 200,
      "pinned": false,
      "maxIdleTimeInSeconds": 30,
      "statusTimeoutInSeconds": 30,
      "pubsubTopics": {
        "0": {
          "topic": "dt/app/+/status/update",
          "type": "PUB_SUB"
        }
      }
    }
  },

Any guidance here would be greatly appreciated! Thanks

profile picture
rodmaz
已提問 1 年前檢視次數 464 次
1 個回答
1
已接受的答案

Merge updates are in a deployment, they do not update the recipe of the component.

The merge is the correct way to set the access control. You can view the actual configuration which is applied on the device by using the local greengrass CLI. https://docs.aws.amazon.com/greengrass/v2/developerguide/gg-cli-component.html#component-details

AWS
專家
已回答 1 年前
profile pictureAWS
專家
Greg_B
已審閱 6 個月前
profile picture
專家
已審閱 10 個月前
  • We checked using Greengrass-cli in GG Core and the accessControl is there. Works like a charm! Thanks!

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南