AWS greengrass documentation change
Summary
Updated documentation to include Greengrass nucleus lite support for hardware security modules (HSM) and PKCS#11, clarifying version requirements and fleet provisioning compatibility.
Security assessment
This change adds documentation about security features (hardware security modules and PKCS#11 support) but does not indicate a security vulnerability fix. It expands coverage to include Greengrass nucleus lite component and clarifies existing security feature support. The change mentions that Greengrass nucleus lite v2.5.0+ has built-in PKCS#11 support and supports hardware security with fleet provisioning, which enhances security documentation but doesn't address a specific security issue.
Diff
diff --git a/greengrass/v2/developerguide/hardware-security.md b/greengrass/v2/developerguide/hardware-security.md index 390a63807..99328858e 100644 --- a//greengrass/v2/developerguide/hardware-security.md +++ b//greengrass/v2/developerguide/hardware-security.md @@ -7 +7 @@ -RequirementsBest practicesInstall the AWS IoT Greengrass Core software with hardware securityConfigure hardware security on an existing core deviceUse hardware without PKCS#11 supportSee also +RequirementsBest practicesInstall the Greengrass nucleus software with hardware securityConfigure hardware security on an existing Greengrass nucleus core deviceUse hardware without PKCS#11 supportSee also @@ -13 +13,3 @@ RequirementsBest practicesInstall the AWS IoT Greengrass Core software with hard -This feature is available for v2.5.3 and later of the [Greengrass nucleus component](./greengrass-nucleus-component.html). AWS IoT Greengrass doesn't currently support this feature on Windows core devices. +For [Greengrass nucleus](./greengrass-nucleus-component.html), this feature requires v2.5.3 or later. AWS IoT Greengrass doesn't currently support this feature on Windows core devices. + +[Greengrass nucleus lite](./greengrass-nucleus-lite-component.html) v2.5.0 and later include built-in PKCS#11 support and do not require the PKCS#11 provider component. You must have an OpenSSL provider configured for your PKCS#11 device. For more information, see [PKCS#11 support](https://github.com/aws-greengrass/aws-greengrass-lite/blob/main/docs/PKCS11_SUPPORT.md) in the AWS IoT Greengrass nucleus lite GitHub repository. @@ -31 +33 @@ Search for devices that support this feature in the [AWS Partner Device Catalog] - * Install the AWS IoT Greengrass Core software with hardware security + * Install the Greengrass nucleus software with hardware security @@ -33 +35 @@ Search for devices that support this feature in the [AWS Partner Device Catalog] - * Configure hardware security on an existing core device + * Configure hardware security on an existing Greengrass nucleus core device @@ -46 +48 @@ You must meet the following requirements to use an HSM on a Greengrass core devi - * [Greengrass nucleus](./greengrass-nucleus-component.html) v2.5.3 or later installed on the core device. You can choose a compatible version when you install the AWS IoT Greengrass Core software on a core device. + * [Greengrass nucleus](./greengrass-nucleus-component.html) v2.5.3 or later, or [Greengrass nucleus lite](./greengrass-nucleus-lite-component.html) v2.5.0 or later, installed on the core device. If you use [Greengrass nucleus lite](./greengrass-nucleus-lite-component.html), see [PKCS#11 support](https://github.com/aws-greengrass/aws-greengrass-lite/blob/main/docs/PKCS11_SUPPORT.md) in the AWS IoT Greengrass nucleus lite GitHub repository for setup instructions. @@ -150 +152 @@ The security best practice to rotate keys doesn't apply when you generate privat -## Install the AWS IoT Greengrass Core software with hardware security +## Install the [Greengrass nucleus](./greengrass-nucleus-component.html) software with hardware security @@ -182 +184 @@ Choose this option to develop a custom Java application that automatically creat -Currently, AWS IoT Greengrass doesn't support installing the AWS IoT Greengrass Core software with hardware security when you [install with automatic resource provisioning](./quick-installation.html) or [AWS IoT fleet provisioning](./fleet-provisioning.html). +The [Greengrass nucleus](./greengrass-nucleus-component.html) doesn't support installing the AWS IoT Greengrass Core software with hardware security when you [install with automatic resource provisioning](./quick-installation.html) or [AWS IoT fleet provisioning](./fleet-provisioning.html). [Greengrass nucleus lite](./greengrass-nucleus-lite-component.html) v2.5.0 and later support hardware security with fleet provisioning. @@ -184 +186 @@ Currently, AWS IoT Greengrass doesn't support installing the AWS IoT Greengrass -## Configure hardware security on an existing core device +## Configure hardware security on an existing [Greengrass nucleus](./greengrass-nucleus-component.html) core device