AWS greengrass documentation change
Summary
Added new error codes (MISSING_MQTT_CONNECT_POLICY, CREDENTIAL_ENDPOINT_AUTH_FAILURE, MQTT_CONNECTION_FAILED, TLS_HANDSHAKE_FAILURE, CREDENTIAL_ENDPOINT_SERVER_ERROR) with troubleshooting guidance.
Security assessment
Changes document deployment error scenarios related to connectivity and permissions. While referencing security elements (TLS, policies), they don't address specific vulnerabilities or introduce new security features.
Diff
diff --git a/greengrass/v2/developerguide/troubleshooting-deployment.md b/greengrass/v2/developerguide/troubleshooting-deployment.md index 1fc261a57..cb47d9ff9 100644 --- a//greengrass/v2/developerguide/troubleshooting-deployment.md +++ b//greengrass/v2/developerguide/troubleshooting-deployment.md @@ -114,0 +115,10 @@ You might get this error either when the device's token exchange role doesn't al +MISSING_MQTT_CONNECT_POLICY + + +You might get this error when the AWS IoT policy doesn't allow `iot:Connect` for the client ID that the nucleus uses during the pre-flight connectivity check for an IoT connectivity switch deployment. The pre-flight check uses client ID ``thing-name`#endpoint-switch`. Update the `iot:Connect` resource in the AWS IoT policy to `arn:aws:iot:*:*:client/`thing-name`*` to allow both the standard and pre-flight client IDs. + +CREDENTIAL_ENDPOINT_AUTH_FAILURE + + +You might get this error when the AWS IoT Credential Provider returns a 401, 403, or 404 response during the pre-flight credential endpoint check for an IoT connectivity switch deployment. Verify that the role alias exists in the destination Region, that you authorized the device certificate for the role alias, and that the AWS IoT policy includes `iot:AssumeRoleWithCertificate` permission. + @@ -450,0 +461,10 @@ You might get this error when there is a connection issue during a deployment. C +MQTT_CONNECTION_FAILED + + +You might get this error when the pre-flight MQTT connection to the new AWS IoT data endpoint fails during an IoT connectivity switch deployment. Check that the endpoint is correct, the device has network connectivity to the endpoint, and no firewall rules block MQTT traffic on the configured port. + +TLS_HANDSHAKE_FAILURE + + +You might get this error when the TLS handshake fails during the pre-flight connectivity check to the new AWS IoT data endpoint. Verify that you registered the device certificate in the destination account and that the root CA certificate on the device trusts the endpoint. + @@ -511,0 +532,5 @@ You might get this error when an Amazon S3 operation returns a 500 error. Check +CREDENTIAL_ENDPOINT_SERVER_ERROR + + +You might get this error when the AWS IoT Credential Provider returns a server error or is unreachable after all retries during the pre-flight credential endpoint check for an IoT connectivity switch deployment. This typically indicates a transient service issue. Retry the deployment. If the error persists, check the AWS IoT Credential Provider service health in the destination Region. +