- Newest
- Most votes
- Most comments
Cross account artifacts do seem to work as long as the S3 bucket and IoT-Core regions match. Trying to create a Component in us-east-1
using an artifact from an S3 bucket in us-east-2
does not work (no matter which account the S3 bucket lives in...).
@AWS is this a known issue and are there plans to fix this? It doesn't seem like desirable behavior. For now I'll set up cross-region replication in my central account I guess...
Thanks for doing this and sharing your results. We found the same thing. Disappointing this was not in the docs..
Hi, cross-region buckets are not supported at this time. There is a troubleshooting entry which applies to this error here: https://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting.html#:~:text=Check%20that%20the%20S3%20bucket%20is%20in%20the%20same%20AWS%20Region%20where%20you%20create%20the%20component.%20AWS%20IoT%20Greengrass%20doesn%27t%20support%20cross%2DRegion%20requests%20for%20component%20artifacts..
Relevant content
- Accepted Answerasked 4 years ago
- AWS OFFICIALUpdated 10 months ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 2 years ago
More things that don't work:
s3:ListBucket
to all the attempted service principals.I've confirmed using the
aws cli
that if I assume theGreengrassV2TokenExchangeRole
in a tenant account, I can boths3:GetObject
ands3:ListBucket
on the artifact in the central account.I even made the artifact bucket public with public access and still can't create a component using the artifact...
The issue seems to be that my buckets are in
us-east-2
and I'm trying to create the components in IoT-Coreus-east-1
... even within the same account I can't use an artifact from a bucket inus-east-2
to create a component in IoT-Coreus-east-1
.Turns out this is purely a region issue. A cross-account S3 bucket can be used to create a component as long as the bucket is in the same region as the IoT-Core you're working in... is this a known thing that I missed?