AWS Greengrass V2 Secure Tunneling Component

Question

Hi Team,

We are facing an issue while using SecureTunneling component provided by AWS itself. Getting following permission related issues when checked "aws.greengrass.SecureTunneling.log" following lines are printed. Moreover, when create tunnel for that specific device from AWS Console. Both the end connection is successfully shown after running localproxy from source token.

But with localproxy while trying to SSH with following command nothing works.

ssh root@localhost -p 5555

On Device "aws.greengrass.SecureTunneling.log" error is as below :

2024-06-27T12:02:38.255Z [INFO] (Copier) aws.greengrass.SecureTunneling: stdout. [ERROR] 2024-06-27 12:02:38.254 [pool-3-thread-1] SubscribeResponseHandler - Secure Tunneling Process: 2024-06-27T12:02:38.234Z [WARN]  {FileUtils.cpp}: Per
missions to given file/dir path '/tmp/device-client-settings.json90018860253406727291719489691381' is not set to recommended value... {Permissions: {desired: 640, actual: 644}}. {scriptName=services.aws.greengrass.SecureTunneling.lifecyc
le.run.script, serviceName=aws.greengrass.SecureTunneling, currentState=RUNNING}

OS installed on device is ubuntu with arm64 architecture. I do have provided merge/update in component with following configuration.

{
  "reset": [],
  "merge": {
    "OS_DIST_INFO": "ubuntu"
  }
}

Giovanni Lauria · Answer

You can change the file permission with a chmod command.

Additionally, AWS IoT Secure Tunneling might run into connectivity issues even if the tunnel is open. One possible solution is to rotate the client access tokens. If you’re not sure whether the client access token needs to be rotated on the source or destination, you can rotate the client access token on both the source and destination by setting ClientMode to ALL when using the RotateTunnelAccessToken API.

Look at the doc:
https://docs.aws.amazon.com/iot/latest/developerguide/iot-secure-tunneling-troubleshooting.html

AWS Greengrass V2 Secure Tunneling Component

Relevant content