AWS greengrass documentation change
Summary
Added support for nucleus v2.18.x and Windows Server 2025; introduced new configuration parameter 'standaloneMqttTimeoutMs' for IoT connectivity switch operations; expanded 'dataPlaneEndpoint' documentation; added release notes for v2.18.0 including connectivity switching feature and bug fixes.
Security assessment
Changes primarily add new features (connectivity switching) and platform support. Bug fixes address reliability (startup timing, stale subscriptions) but lack explicit security vulnerability context. No evidence of patching a specific security weakness.
Diff
diff --git a/greengrass/v2/developerguide/greengrass-nucleus-component.md b/greengrass/v2/developerguide/greengrass-nucleus-component.md index 3f4d7e4f3..56d3ab05f 100644 --- a//greengrass/v2/developerguide/greengrass-nucleus-component.md +++ b//greengrass/v2/developerguide/greengrass-nucleus-component.md @@ -53,0 +54,2 @@ This component has the following versions: + * 2.18.x + @@ -237,0 +240,2 @@ Versions: + * Windows Server 2025 + @@ -435,0 +440,11 @@ Default: `100` +`standaloneMqttTimeoutMs` + + +(Optional) The time, in milliseconds, that the nucleus waits for standalone MQTT connections during IoT connectivity switch operations. This timeout covers the pre-flight connectivity check and the status report that the nucleus sends to the source account after a successful switch. + +This feature requires v2.18.0 or later of this component. + +Default: `60000` (60 seconds) + +Valid range: Minimum value of 1 + @@ -559 +574,14 @@ This feature is available in v2.7.0 and later of this component. -For more information, see [Use a device certificate signed by a private CA](./configure-greengrass-core-v2.html#configure-nucleus-private-ca). +(Optional) The Greengrass data plane endpoint to use. Set to `iotdata` to use the same endpoint as the IoT data endpoint specified in `iotDataEndpoint`. + +You must set this option to `iotdata` in the following cases: + + * You use a device certificate signed by a private certificate authority (CA). For more information, see [Use a device certificate signed by a private CA](./configure-greengrass-core-v2.html#configure-nucleus-private-ca). + + * You deploy nucleus configuration updates to switch the device's IoT connectivity to a different AWS account or Region. Without this setting, the data plane remains bound to the original account after the connectivity switch. This breaks component artifact downloads and control plane operations. For more information, see [Switch a Greengrass core device to a different AWS account or Region](./switch-core-device-connectivity.html). + + + + +You can set this option during deployment or installation using the `--init-config` [installer argument](./configure-installer.html). + +Default: `""` (empty string – uses the Greengrass service endpoint) @@ -932,0 +961,17 @@ The following table describes the changes in each version of the component. +2.18.0 | + +New features + + + * Adds support for switching a core device's AWS IoT connectivity to a different AWS account or region through a nucleus configuration deployment. The nucleus validates connectivity to the new endpoints before it applies the change, and reports the terminal deployment status to the source account. + * Adds support for Windows Server 2025. + + +Bug fixes and improvements + + + * Fixes a startup timing issue on systemd devices by starting the AWS IoT Greengrass Core software only after the system clock synchronizes. + * Fixes an issue where a component might encounter stale subscriptions after it closes a local IPC stream during an in-progress subscribe request. + * General bug fixes and improvements. + +