Amazon IoT Greengrass Version 1 entered the extended life phase on June 30, 2023. For more information, see the Amazon IoT Greengrass V1 maintenance policy. After this date, Amazon IoT Greengrass V1 won't release updates that provide features, enhancements, bug fixes, or security patches. Devices that run on Amazon IoT Greengrass V1 won't be disrupted and will continue to operate and to connect to the cloud. We strongly recommend that you migrate to Amazon IoT Greengrass Version 2, which adds significant new features and support for additional platforms.
Encryption in transit
Amazon IoT Greengrass has three modes of communication where data is in transit:
-
Data in transit over the internet. Communication between a Greengrass core and Amazon IoT Greengrass over the internet is encrypted.
-
Data in transit over the local network. Communication between a Greengrass core and client devices over a local network is encrypted.
-
Data on the core device. Communication between components on the Greengrass core device is not encrypted.
Data in transit over the internet
Amazon IoT Greengrass uses Transport Layer Security (TLS) to encrypt all communication over the internet. All data sent to the Amazon Web Services Cloud is sent over a TLS connection using MQTT or HTTPS protocols, so it is secure by default. Amazon IoT Greengrass uses the Amazon IoT transport security model. For more information, see Transport security in the Amazon IoT Core Developer Guide.
Data in transit over the local network
Amazon IoT Greengrass uses TLS to encrypt all communication over the local network between the Greengrass core and client devices. For more information, see Supported Cipher Suites for Local Network Communication.
It is your responsibility to protect the local network and private keys.
- For Greengrass core devices, it's your responsibility to:
Keep the kernel updated with the latest security patches.
Keep system libraries updated with the latest security patches.
Protect private keys. For more information, see Key management for the Greengrass core device.
- For client devices, it's your responsibility to:
Keep the TLS stack up to date.
Protect private keys.
Data on the core device
Amazon IoT Greengrass doesn't encrypt data exchanged locally on the Greengrass core device because the data doesn't leave the device. This includes communication between user-defined Lambda functions, connectors, the Amazon IoT Greengrass Core SDK, and system components, such as stream manager.