Repository navigation
docs(spec): Quick Setup IoT thing policy and cross-account provisioning - #114
Merged
Merged
Conversation
… cross-account provisioning Two specs for the gaps left after #110: - quick-setup-iot-thing-policy: the station can still create versions of the shared GreengrassV2IoTThingPolicy and attach any IoT policy to any certificate. Phase 1 moves the policy writes into the Lambda's preparation session (and fixes the shadow statement repair, which Quick Setup could not run: no iot:GetPolicyVersion); phase 2, a decision point, creates the certificate from a CSR in the portal so the station needs no IoT write. - quick-setup-cross-account-provisioning: DDAPortalAccessRole lacks the installer's provisioning actions, so cross-account Quick Setup cannot provision a device. A dedicated DDAStationProvisioningRole per use-case account, assumed by the quick_setup Lambda, with the portal's ceiling.
Approved on 2026-10-30: - quick-setup-iot-thing-policy: both phases. Phase 1 ships first; phase 2 (the portal creates the certificate from a CSR, no IoT write on the station) builds on its Preparation_Session. - quick-setup-cross-account-provisioning: no DDAPortalAccessRole fallback. The inline-only token exchange role preparation is removed; an account without the dedicated role gets the 503 and its remedy. The cross-account role carries the UseCase account's permissions boundary, which is being added.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two Kiro specs for what #110 left open. Docs only.
.kiro/specs/quick-setup-iot-thing-policy/: the station's Quick Setup credentials can still create new versions of the sharedGreengrassV2IoTThingPolicy, which every device certificate in the account uses, and can attach any IoT policy to any certificate.iot:GetPolicyVersiondenied..kiro/specs/quick-setup-cross-account-provisioning/:DDAPortalAccessRolelacks the Greengrass installer's provisioning actions, so cross-account Quick Setup cannot provision a device. This was found by reading the stack; it has not been run. The spec adds a dedicatedDDAStationProvisioningRoleper use-case account, assumed by thequick_setupLambda, with the portal's ceiling.DDAPortalAccessRoledoes not grow.Each spec has requirements, a design and tasks. The decision points are marked in the designs.