How to create a secret resource (console)

Sign in to the Amazon Secrets Manager console.

Choose Store a new secret.

Under Choose secret type, choose Other type of secret.

Under Specify the key-value pairs to be stored for this secret:

Keep aws/secretsmanager selected for the encryption key, and then choose Next.

For Secret name, enter greengrass-TestSecret, and then choose Next.

This tutorial doesn't require rotation, so choose disable automatic rotation, and then choose Next.

On the Review page, review your settings, and then choose Store.

Next, you create a secret resource in your Greengrass group that references the secret.

In the Amazon IoT console navigation pane, under Manage, expand Greengrass devices, and then choose Groups (V1).

Choose the group that you want to add the secret resource to.

On the group configuration page, choose the Resources tab, and then scroll down to the Secrets section. The Secrets section displays the secret resources that belong to the group. You can add, edit, and remove secret resources from this section.

Choose Add under the Secrets section.

On the Add a secret resource page, enter MyTestSecret in the Resource name.

Under Secret, choose greengrass-TestSecret.

In the Select labels (Optional) section, the AWSCURRENT staging label represents the latest version of the secret. This label is always included in a secret resource.

Choose Add resource.

From the Amazon IoT Greengrass Core SDK downloads page, download the Amazon IoT Greengrass Core SDK for Python to your computer.

Unzip the downloaded package to get the SDK. The SDK is the greengrasssdk folder.

Save the following Python code function in a local file named secret_test.py.

import greengrasssdk

secrets_client = greengrasssdk.client("secretsmanager")
iot_client = greengrasssdk.client("iot-data")
secret_name = "greengrass-TestSecret"
send_topic = "secrets/output"


def function_handler(event, context):
    """
    Gets a secret and publishes a message to indicate whether the secret was
    successfully retrieved.
    """
    response = secrets_client.get_secret_value(SecretId=secret_name)
    secret_value = response.get("SecretString")
    message = (
        f"Failed to retrieve secret {secret_name}."
        if secret_value is None
        else f"Successfully retrieved secret {secret_name}."
    )
    iot_client.publish(topic=send_topic, payload=message)
    print("Published: " + message)

The get_secret_value function supports the name or ARN of the Secrets Manager secret for the SecretId value. This example uses the secret name. For this example secret, Amazon IoT Greengrass returns the key-value pair: {"test":"abcdefghi"}.

Zip the following items into a file named secret_test_python.zip. When you create the ZIP file, include only the code and dependencies, not the containing folder.

This is your Lambda function deployment package.

First, create the Lambda function.

1. In the Amazon Web Services Management Console, choose Services, and open the Amazon Lambda console.

2. Choose Create function and then choose Author from scratch.

3. In the Basic information section, use the following values:

   • For Function name, enter SecretTest.

   • For Runtime, choose Python 3.7.

   • For Permissions, keep the default setting. This creates an execution role that grants basic Lambda permissions. This role isn't used by Amazon IoT Greengrass.

4. At the bottom of the page, choose Create function.

Next, register the handler and upload your Lambda function deployment package.

1. On the Code tab, under Code source, choose Upload from. From the dropdown, choose .zip file.

   

2. Choose Upload, then choose your secret_test_python.zip deployment package. Then, choose Save.

3. On the Code tab for the function, under Runtime settings, choose Edit, and then enter the following values.

   • For Runtime, choose Python 3.7.

   • For Handler, enter secret_test.function_handler

4. Choose Save.

   Note

   The Test button on the Amazon Lambda console doesn't work with this function. The Amazon IoT Greengrass Core SDK doesn't contain modules that are required to run your Greengrass Lambda functions independently in the Amazon Lambda console. These modules (for example, greengrass_common) are supplied to the functions after they are deployed to your Greengrass core.

Now, publish the first version of your Lambda function and create an alias for the version.

1. From the Actions menu, choose Publish new version.

2. For Version description, enter First version, and then choose Publish.

3. On the SecretTest: 1 configuration page, from the Actions menu, choose Create alias.

4. On the Create a new alias page, use the following values:

   • For Name, enter GG_SecretTest.

   • For Version, choose 1.

   Note

   Amazon IoT Greengrass doesn't support Lambda aliases for $LATEST versions.

5. Choose Create.

On the group configuration page, choose the Lambda functions tab.

Under the My Lambda functions section, choose Add.

For the Lambda function, choose SecretTest.

For the Lambda function version, choose the alias to the version that you published.

In the Lambda function configuration section, make the following updates.

1. To run without containerization:

   • For System user and group, choose Another user ID/group ID. For System user ID, enter 0. For System group ID, enter 0.

     This allows your Lambda function to run as root. For more information about running as root, see Setting the default access identity for Lambda functions in a group.

     Tip

     You also must update your config.json file to grant root access to your Lambda function. For the procedure, see Running a Lambda function as root.

   • For Lambda function containerization, choose No container.

     For more information about running without containerization, see Considerations when choosing Lambda function containerization.

   • For Timeout, enter 10 seconds.

   • For Pinned, choose True.

     For more information, see Lifecycle configuration for Greengrass Lambda functions.

   • Under Additional Parameter, for Read access to /sys directory, choose Enabled.

2. To run in containerized mode instead:

   Note

   We do not recommend running in containerized mode unless your business case requires it.

   • For System user and group, choose Use group default.

   • For Lambda function containerization, choose Use group default.

   • For Memory limit, enter 1024 MB.

   • For Timeout, enter 10 seconds.

   • For Pinned, choose True.

     For more information, see Lifecycle configuration for Greengrass Lambda functions.

   • Under Additional Parameters, for Read access to /sys directory, choose Enabled.

Choose Add Lambda function.

On the group configuration page, choose the Lambda functions tab.

Choose the SecretTest function.

On the function's details page, choose Resources.

Scroll to the Secrets section and choose Associate.

Choose MyTestSecret, and then choose Associate.

On the group configuration page, choose the Subscriptions tab, and then choose Add Subscription.

Create a subscription that allows Amazon IoT to publish messages to the function.

On the group configuration page, choose the Subscriptions tab, and then choose Add subscription.

On the Create a subscription page, configure the source and target, as follows:

1. In Source type, choose Lambda function, and then choose IoT Cloud.

2. In Target type, choose Service, and then choose SecretTest.

3. In the Topic filter, enter secrets/input, and then choose Create subscription.

Add a second subscription. Choose the Subscriptions tab, choose Add subscription, and configure the source and target, as follows:

1. In Source type, choose Services, and then choose SecretTest.

2. In Target type, choose Lambda function, and then choose IoT Cloud.

3. In the Topic filter, enter secrets/output, and then choose Create subscription.

Make sure that the Amazon IoT Greengrass core is running. Run the following commands in your Raspberry Pi terminal, as needed.

1. To check whether the daemon is running:

   ps aux | grep -E 'greengrass.*daemon'

   If the output contains a root entry for /greengrass/ggc/packages/ggc-version/bin/daemon, then the daemon is running.

   Note

   The version in the path depends on the Amazon IoT Greengrass Core software version that's installed on your core device.

2. To start the daemon:

   cd /greengrass/ggc/core/
   sudo ./greengrassd start

On the group configuration page, choose Deploy.

1. In the Lambda functions tab, under the System Lambda functions section, select IP detector and choose Edit.

2. In the Edit IP detector settings dialog box, select Automatically detect and override MQTT broker endpoints.

3. Choose Save.

   This enables devices to automatically acquire connectivity information for the core, such as IP address, DNS, and port number. Automatic detection is recommended, but Amazon IoT Greengrass also supports manually specified endpoints. You're only prompted for the discovery method the first time that the group is deployed.

   Note

   If prompted, grant permission to create the Greengrass service role and associate it with your Amazon Web Services account in the current Amazon Web Services Region. This role allows Amazon IoT Greengrass to access your resources in Amazon services.

   The Deployments page shows the deployment timestamp, version ID, and status. When completed, the status displayed for the deployment should be Completed.

   For troubleshooting help, see Troubleshooting Amazon IoT Greengrass.

On the Amazon IoT console home page, choose Test.

For Subscribe to topic, use the following values, and then choose Subscribe.

For Publish to topic, use the following values, and then choose Publish to invoke the function.

If successful, the function publishes a "Success" message.