Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions,
see Getting Started with Amazon Web Services in China
(PDF).
Minimal IAM policy for installer to provision
resources
When you install the Amazon IoT Greengrass Core software, you can provision required Amazon resources, such as an
Amazon IoT thing and an IAM role for your device. You can also deploy local development tools to
the device. The installer requires Amazon credentials so that it can perform these actions in
your Amazon Web Services account. For more information, see Install the Amazon IoT Greengrass Core software.
The following example policy includes the minimum set of actions that the installer requires
to provision these resources. These permissions are required if you specify the
--provision
argument for the installer. Replace account-id
with your
Amazon Web Services account ID, and replace GreengrassV2TokenExchangeRole
with the
name of the token exchange role that you specify with the --tes-role-name
installer argument.
The DeployDevTools
policy statement is required only if you specify the
--deploy-dev-tools
argument for the installer.
- Greengrass nucleus v2.5.0 and later
-
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CreateTokenExchangeRole",
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy",
"iam:CreatePolicy",
"iam:CreateRole",
"iam:GetPolicy",
"iam:GetRole",
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::account-id
:role/GreengrassV2TokenExchangeRole
",
"arn:aws:iam::account-id
:policy/GreengrassV2TokenExchangeRole
Access",
"arn:aws:iam::aws:policy/GreengrassV2TokenExchangeRole
Access"
]
},
{
"Sid": "CreateIoTResources",
"Effect": "Allow",
"Action": [
"iot:AddThingToThingGroup",
"iot:AttachPolicy",
"iot:AttachThingPrincipal",
"iot:CreateKeysAndCertificate",
"iot:CreatePolicy",
"iot:CreateRoleAlias",
"iot:CreateThing",
"iot:CreateThingGroup",
"iot:DescribeEndpoint",
"iot:DescribeRoleAlias",
"iot:DescribeThingGroup",
"iot:GetPolicy"
],
"Resource": "*"
},
{
"Sid": "DeployDevTools",
"Effect": "Allow",
"Action": [
"greengrass:CreateDeployment",
"iot:CancelJob",
"iot:CreateJob",
"iot:DeleteThingShadow",
"iot:DescribeJob",
"iot:DescribeThing",
"iot:DescribeThingGroup",
"iot:GetThingShadow",
"iot:UpdateJob",
"iot:UpdateThingShadow"
],
"Resource": "*"
}
]
}
- Earlier than v2.5.0
-
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CreateTokenExchangeRole",
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy",
"iam:CreatePolicy",
"iam:CreateRole",
"iam:GetPolicy",
"iam:GetRole",
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::account-id
:role/GreengrassV2TokenExchangeRole
",
"arn:aws:iam::account-id
:policy/GreengrassV2TokenExchangeRole
Access",
"arn:aws:iam::aws:policy/GreengrassV2TokenExchangeRole
Access"
]
},
{
"Sid": "CreateIoTResources",
"Effect": "Allow",
"Action": [
"iot:AddThingToThingGroup",
"iot:AttachPolicy",
"iot:AttachThingPrincipal",
"iot:CreateKeysAndCertificate",
"iot:CreatePolicy",
"iot:CreateRoleAlias",
"iot:CreateThing",
"iot:CreateThingGroup",
"iot:DescribeEndpoint",
"iot:DescribeRoleAlias",
"iot:DescribeThingGroup",
"iot:GetPolicy"
],
"Resource": "*"
},
{
"Sid": "DeployDevTools",
"Effect": "Allow",
"Action": [
"greengrass:CreateDeployment",
"iot:CancelJob",
"iot:CreateJob",
"iot:DeleteThingShadow",
"iot:DescribeJob",
"iot:DescribeThing",
"iot:DescribeThingGroup",
"iot:GetThingShadow",
"iot:UpdateJob",
"iot:UpdateThingShadow"
],
"Resource": "*"
}
]
}