AWS greengrass documentation change

Service: greengrass · 2026-04-19 · Documentation medium

File: greengrass/v2/developerguide/greengrass-nucleus-lite-component.md

Summary

Added versions 2.5.x and 2.4.x; added note about running as non-root using rootless containers; added detailed release notes for v2.5.0 (PKCS#11 support, TPM with fleet provisioning), v2.4.0, and v2.3.3 with bug fixes

Security assessment

The change documents significant security features: PKCS#11 support for hardware security modules, TPM support for fleet provisioning, and running as non-root. The bug fixes mentioned (like artifact permissions ownership issue and file descriptor leaks) could have security implications, but they're described as general bug fixes without evidence of being security vulnerabilities. This adds comprehensive security feature documentation.

Diff

diff --git a/greengrass/v2/developerguide/greengrass-nucleus-lite-component.md b/greengrass/v2/developerguide/greengrass-nucleus-lite-component.md
index 6b762aea9..a553c8280 100644
--- a//greengrass/v2/developerguide/greengrass-nucleus-lite-component.md
+++ b//greengrass/v2/developerguide/greengrass-nucleus-lite-component.md
@@ -39,0 +40,4 @@ This component has the following versions:
+  * 2.5.x
+
+  * 2.4.x
+
@@ -81,0 +86,2 @@ The Greengrass nucleus component is supported to run in a VPC. To deploy this co
+To run AWS IoT Greengrass nucleus lite as a non-root user, you can use a rootless container. For more information, see [Using Podman](https://github.com/aws-greengrass/aws-greengrass-lite/blob/main/docs/BUILD.md#optional-using-podman) in the AWS IoT Greengrass nucleus lite GitHub repository.
+
@@ -201,0 +208,45 @@ Messages are logged to stdout and log files are handled by systemd.
+2.5.0 | 
+
+New features
+    
+
+  * Adds PKCS#11 support. You can use PKCS#11-backed key and certificate handles with OpenSSL Providers.
+  * Adds support for using TPM with fleet provisioning.
+
+
+Bug fixes and improvements
+    
+
+  * Fixes a fleet provisioning regression introduced in v2.4.0.
+  * Fixes an artifact permissions ownership issue introduced in v2.4.0.
+
+  
+2.4.0 | 
+
+New features
+    
+
+  * Adds support for local deployment `--group-name` and `--remove-component` options.
+  * Applies artifact permissions from recipes.
+
+
+Bug fixes and improvements
+    
+
+  * Fixes an issue where MQTT messages could be delayed until the next keepalive interval.
+  * Fixes an issue where iotcored might enter deadlock and be unable to reconnect.
+  * Fixes SSL verification failures when using an HTTP proxy.
+  * Improves connection reliability.
+
+  
+2.3.3 | 
+
+Bug fixes and improvements
+    
+
+  * Fixes leak of file descriptors when creating components during deployment.
+  * Fixes an issue where deployment job status reports might be rejected.
+  * Allows component install phases to retry up to 3 times before failing deployment.
+  * General bug fixes and improvements.
+
+