AWS greengrass documentation change
Summary
Updated documentation for CloudWatch metrics component version 4.0.x, added new configuration parameters, updated dependencies, and clarified Python library requirements with new UseInstaller option.
Security assessment
The changes add documentation for the 'accessControl' configuration parameter which defines authorization policies for interprocess communication (IPC) and MQTT proxy operations. This is a security feature that controls component permissions for publishing/subscribing to topics. However, there is no evidence this addresses a specific security vulnerability or incident - it appears to be routine version documentation updates.
Diff
diff --git a/greengrass/v2/developerguide/cloudwatch-metrics-component.md b/greengrass/v2/developerguide/cloudwatch-metrics-component.md index b00794219..40fc4cea8 100644 --- a//greengrass/v2/developerguide/cloudwatch-metrics-component.md +++ b//greengrass/v2/developerguide/cloudwatch-metrics-component.md @@ -53,0 +54,2 @@ This component has the following versions: + * 4.0.x + @@ -71 +73 @@ For information about changes in each version of the component, see the changelo -v3.x +v4.x - v3.x @@ -85 +87 @@ For more information, see [Component types](./develop-greengrass-components.html -v3.x +v4.x - v3.x @@ -106 +108 @@ This component has the following requirements: -3.x +v4.x - v3.x @@ -110,0 +113,10 @@ This component has the following requirements: + * The following Python libraries, including any dependencies, must be installed and available to the user running the component: + + * [AWS IoT Device SDK v2 for Python](https://github.com/aws/aws-iot-device-sdk-python-v2) + + * [AWS SDK for Python (Boto3)](http://boto.readthedocs.org/en/latest/ref/) + +###### Note + +You can set the `UseInstaller` configuration to `true` to install these libraries automatically into the provided Python environment. + @@ -230 +242 @@ When you deploy a component, AWS IoT Greengrass also deploys compatible versions -3.2.0 +4.0.0 - 3.0.0 @@ -233,11 +245 @@ When you deploy a component, AWS IoT Greengrass also deploys compatible versions -The following table lists the dependencies for versions 3.2.0 of this component. - -Dependency | Compatible versions | Dependency type ----|---|--- -[Greengrass nucleus](./greengrass-nucleus-component.html) | >=2.0.0 <3.0.0 | Soft -[Token exchange service](./token-exchange-service-component.html) | >=0.0.0 | Hard - -3.0.0 - 3.1.0 - - -The following table lists the dependencies for versions 3.0.0 to 3.1.0 of this component. +The following table lists the dependencies for versions 4.0.0 to 3.0.0 of this component. @@ -375,0 +378,154 @@ This component provides the following configuration parameters that you can cust +v4.x + + +`PublishInterval` + + +(Optional) The maximum number of seconds to wait before the component publishes batched metrics for a given namespace. To configure the component to publish metrics as it receives them, which means without batching, specify `0`. + +The component publishes to CloudWatch after it receives 20 metrics in the same namespace or after the interval that you specify. + +###### Note + +The component doesn't specify the order in which events publish. + +This value can be a maximum of 900 seconds. + +Default: 10 seconds + +`MaxMetricsToRetain` + + +(Optional) The maximum number of metrics across all namespaces to save in memory before the component replaces them with newer metrics. + +This limit applies when the core device doesn't have a connection to the internet, so the component buffers the metrics to publish later. When the buffer is full, the component replaces the oldest metrics with newer ones. Metrics in a given namespace replace only metrics in the same namespace. + +###### Note + +If the host process for the component is interrupted, the component doesn't save metrics. This can happen during a deployment or when the core device restarts, for example. + +This value must be at least 2,000 metrics. + +Default: 5,000 metrics + +`InputTopic` + + +(Optional) The topic to which the component subscribes to receive messages. If you specify `true` for `PubSubToIoTCore`, you can use MQTT wildcards (+ and #) in this topic. + +Default: `cloudwatch/metric/put` + +`OutputTopic` + + +(Optional) The topic to which the component publishes status responses. + +Default: `cloudwatch/metric/put/status` + +`PubSubToIoTCore` + + +(Optional) String value that defines whether to publish and subscribe to AWS IoT Core MQTT topics. Supported values are `true` and `false`. + +Default: `false` + +`LogLevel` + + +(Optional) The logging level for the component. Choose from the following log levels, listed here in level order: + + * `DEBUG` + + * `INFO` + + * `WARNING` + + * `ERROR` + + * `CRITICAL` + + + + +Default: `INFO` + +`UseInstaller` + + +(Optional) Boolean value that defines whether to use the installer script to install this component's Python dependencies into the provided Python environment. + +Set this value to `true` to automatically install this component's Python dependencies. When set to `false`, you must install the following libraries, including any dependencies, and make them available to the Python environment provided to the user running the component. + + * [AWS IoT Device SDK v2 for Python](https://github.com/aws/aws-iot-device-sdk-python-v2) + + * [AWS SDK for Python (Boto3)](http://boto.readthedocs.org/en/latest/ref/) + + + + +Default: `false` + +`PublishRegion` + + +(Optional) The AWS Region to which to publish CloudWatch metrics. This value overrides the default Region for the core device. This parameter is required only for cross-Region metrics. + +`accessControl` + + +(Optional) The object that contains the [authorization policy](./interprocess-communication.html#ipc-authorization-policies) that allows the component to publish and subscribe to the specified topics. If you specify custom values for `InputTopic` and `OutputTopic`, you must update the resource values in this object. + +Default: + + + { + "aws.greengrass.ipc.pubsub": { + "aws.greengrass.Cloudwatch:pubsub:1": { + "policyDescription": "Allows access to subscribe to input topics.", + "operations": [ + "aws.greengrass#SubscribeToTopic" + ], + "resources": [ + "cloudwatch/metric/put" + ] + }, + "aws.greengrass.Cloudwatch:pubsub:2": { + "policyDescription": "Allows access to publish to output topics.", + "operations": [ + "aws.greengrass#PublishToTopic" + ], + "resources": [ + "cloudwatch/metric/put/status" + ] + } + }, + "aws.greengrass.ipc.mqttproxy": { + "aws.greengrass.Cloudwatch:mqttproxy:1": { + "policyDescription": "Allows access to subscribe to input topics.", + "operations": [ + "aws.greengrass#SubscribeToIoTCore" + ], + "resources": [ + "cloudwatch/metric/put" + ] + }, + "aws.greengrass.Cloudwatch:mqttproxy:2": { + "policyDescription": "Allows access to publish to output topics.", + "operations": [ + "aws.greengrass#PublishToIoTCore" + ], + "resources": [ + "cloudwatch/metric/put/status" + ] + } + } + } + +###### Example: Configuration merge update + + + { + "PublishInterval": 0, + "PubSubToIoTCore": true + } + @@ -453 +609 @@ Default: `INFO` -(Optional) Boolean value that defines whether to use the installer script in this component to install this component's SDK dependencies.