Configure your device to run IDT tests

• The default Greengrass user (ggc_user).

• The user that you use to connect to the device under test. You configure this user in the device.json file.

You must meet the following requirements to allow IDT to use your custom IAM role. We strongly recommend that you add only the minimum required policy actions to this role.

• The userdata.json configuration file must be updated to set the GreengrassV2TokenExchangeRole parameter to true.

• The custom IAM role must be configured with the following minimum trust policy:

  {
     "Version":"2012-10-17",
     "Statement":[
        {
           "Effect":"Allow",
           "Principal":{
              "Service":[
                 "credentials.iot.amazonaws.com",
                 "lambda.amazonaws.com", 
                 "sagemaker.amazonaws.com" 
              ]
           },
           "Action":"sts:AssumeRole"
        }
     ]
  }

• The custom IAM role must be configured with the following minimum permissions policy:

  {
     "Version":"2012-10-17",
     "Statement":[
        {
           "Effect":"Allow",
           "Action":[
              "iot:DescribeCertificate",
              "logs:CreateLogGroup",
              "logs:CreateLogStream",
              "logs:PutLogEvents",
              "logs:DescribeLogStreams",
              "iot:Connect",
              "iot:Publish",
              "iot:Subscribe",
              "iot:Receive",
              "iot:ListThingPrincipals", 
              "iot:GetThingShadow",
              "iot:UpdateThingShadow",
              "s3:GetBucketLocation",
              "s3:GetObject",
              "s3:PutObject",
              "s3:AbortMultipartUpload",
              "s3:ListMultipartUploadParts"
           ],
           "Resource":"*"
        }
     ]
  }

• The name of the custom IAM role must match the IAM role resource that you specify in the IAM permissions for the test user. By default, the test user policy allows access to IAM roles that have the idt- prefix in their role names. If your IAM role name doesn't use this prefix, add the arn:aws:iam::*:role/custom-iam-role-name resource to the roleAliasResources statement and the passRoleForResources statement in your test user policy, as shown in the following examples:

  Example passRoleForResources statement

  {
     "Sid":"passRoleForResources",
     "Effect":"Allow",
     "Action":"iam:PassRole",
     "Resource":"arn:aws:iam::*:role/custom-iam-role-name",
     "Condition":{
        "StringEquals":{
           "iam:PassedToService":[
              "iot.amazonaws.com",
              "lambda.amazonaws.com",
              "greengrass.amazonaws.com"
           ]
        }
     }
  }

  Example roleAliasResources statement

  {
     "Sid":"roleAliasResources",
     "Effect":"Allow",
     "Action":[
        "iot:CreateRoleAlias",
        "iot:DescribeRoleAlias",
        "iot:DeleteRoleAlias",
        "iot:TagResource",
        "iam:GetRole"
     ],
     "Resource":[
        "arn:aws:iot:*:*:rolealias/idt-*",
        "arn:aws:iam::*:role/custom-iam-role-name"
     ]
  }

• Docker Engine 1.9.1 or later installed on the Greengrass core device. Version 20.10 is the latest version that is verified to work with the Amazon IoT Greengrass Core software. You must install Docker directly on the core device before you deploy components that run Docker containers.

• The Docker daemon started and running on the core device before you deploy this component.

• The system user that runs a Docker container component must have root or administrator permissions, or you must configure Docker to run it as a non-root or non-admistrator user.

  • On Linux devices, you can add a user to the docker group to call docker commands without sudo.

  • On Windows devices, you can add a user to the docker-users group to call docker commands without adminstrator privileges.

  Linux or Unix

  To add ggc_user, or the non-root user that you use to run Docker container components, to the docker group, run the following command.

  sudo usermod -aG docker ggc_user

  For more information, see Manage Docker as a non-root user.

  Windows Command Prompt (CMD)

  To add ggc_user, or the user that you use to run Docker container components, to the docker-users group, run the following command as an administrator.

  net localgroup docker-users ggc_user /add

  Windows PowerShell

  To add ggc_user, or the user that you use to run Docker container components, to the docker-users group, run the following command as an administrator.

  Add-LocalGroupMember -Group docker-users -Member ggc_user

• On Greengrass core devices running Amazon Linux 2 or Ubuntu 18.04, GNU C Library (glibc) version 2.27 or later installed on the device.

• On Armv7l devices, such as Raspberry Pi, dependencies for OpenCV-Python installed on the device. Run the following command to install the dependencies.

  sudo apt-get install libopenjp2-7 libilmbase23 libopenexr-dev libavcodec-dev libavformat-dev libswscale-dev libv4l-dev libgtk-3-0 libwebp-dev

• Raspberry Pi devices that run Raspberry Pi OS Bullseye must meet the following requirements:

  • NumPy 1.22.4 or later installed on the device. Raspberry Pi OS Bullseye includes an earlier version of NumPy, so you can run the following command to upgrade NumPy on the device.

    pip3 install --upgrade numpy

  • The legacy camera stack enabled on the device. Raspberry Pi OS Bullseye includes a new camera stack that is enabled by default and isn't compatible, so you must enable the legacy camera stack.

    To enable the legacy camera stack

    1. Run the following command to open the Raspberry Pi configuration tool.

       sudo raspi-config

    2. Select Interface Options.

    3. Select Legacy camera to enable the legacy camera stack.

    4. Reboot the Raspberry Pi.