Secure tunneling

With the aws.greengrass.SecureTunneling component, you can establish secure bidirectional communication with a Greengrass core device located behind restricted firewalls.

For example, imagine you have a Greengrass core device behind a firewall that prohibits all incoming connections. Secure tunneling uses MQTT to transfer an access token to the device and then uses WebSockets to make an SSH connection to the device through the firewall. With this Amazon IoT managed tunnel, you can open the SSH connection needed for your device. For more information about using Amazon IoT secure tunneling to connect to remote devices, see Amazon IoT secure tunneling in the Amazon IoT Developer Guide.

This component subscribes to the Amazon IoT Core MQTT message broker on the $aws/things/greengrass-core-device/tunnels/notify topic to receive secure tunneling notifications.

Versions

This component has the following versions:

Type

This component is a generic component (aws.greengrass.generic). The Greengrass nucleus runs the component's lifecycle scripts.

For more information, see Component types.

Operating system

This component can be installed on Linux core devices only.

Architectures:

Requirements

This component has the following requirements:

Endpoints and ports

This component must be able to perform outbound requests to the following endpoints and ports, in addition to endpoints and ports required for basic operation. For more information, see Allow device traffic through a proxy or firewall.

Dependencies

When you deploy a component, Amazon IoT Greengrass also deploys compatible versions of its dependencies. This means that you must meet the requirements for the component and all of its dependencies to successfully deploy the component. This section lists the dependencies for the released versions of this component and the semantic version constraints that define the component versions for each dependency. You can also view the dependencies for each version of the component in the Amazon IoT Greengrass console. On the component details page, look for the Dependencies list.

For more information about component dependencies, see the component recipe reference.

Configuration

This component provides the following configuration parameters that you can customize when you deploy the component.

{
  "OS_DIST_INFO": "ubuntu",
  "accessControl": {
    "aws.greengrass.ipc.mqttproxy": {
      "aws.iot.SecureTunneling:mqttproxy:1": {
        "policyDescription": "Access to tunnel notification pubsub topic",
        "operations": [
          "aws.greengrass#SubscribeToIoTCore"
        ],
        "resources": [
          "$aws/things/MyGreengrassCore/tunnels/notify"
        ]
      }
    }
  }
}

Local log file

This component uses the following log file.

/greengrass/v2/logs/aws.greengrass.SecureTunneling.log

Licenses

This component includes the following third-party software/licensing:

Usage

To use the secure tunneling component on your device, do the following:

See also

Changelog

The following table describes the changes in each version of the component.