Here’s the comprehensive solution addressing all three focus areas:
Registry Component Status:
First, verify the client devices registry component is running and check its version:
sudo /greengrass/v2/bin/greengrass-cli component list
# Look for aws.greengrass.clientdevices.Registry
Check component logs for detailed errors:
sudo tail -f /greengrass/v2/logs/aws.greengrass.clientdevices.Registry.log
Verify component configuration:
sudo cat /greengrass/v2/config/effectiveConfig.yaml | grep -A 20 clientdevices.Registry
Ensure the component recipe includes cloud sync:
ComponentConfiguration:
DefaultConfiguration:
syncCloudSettings: true
cloudSyncInterval: 300
Network Connectivity:
Test connectivity to all required IoT endpoints:
# IoT Core endpoint
curl -I https://iot.us-east-1.amazonaws.com
# IoT Data endpoint
curl -I https://data.iot.us-east-1.amazonaws.com
# Credentials endpoint
curl -I https://credentials.iot.us-east-1.amazonaws.com
If using VPC endpoints, verify endpoint policies allow the registry component’s operations:
{
"Statement": [{
"Effect": "Allow",
"Principal": "*",
"Action": [
"iot:DescribeThing",
"iot:ListThingPrincipals",
"iot:DescribeCertificate"
],
"Resource": "*"
}]
}
Check DNS resolution for IoT endpoints:
nslookup iot.us-east-1.amazonaws.com
nslookup data.iot.us-east-1.amazonaws.com
IAM Permission for Registry:
Update your Token Exchange Service role with required permissions:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"iot:DescribeThing",
"iot:ListThingPrincipals",
"iot:DescribeCertificate",
"iot:GetThingShadow",
"iot:UpdateThingShadow"
],
"Resource": "*"
}]
}
Apply the updated policy:
aws iam put-role-policy \
--role-name GreengrassTESRole \
--policy-name IoTRegistryAccess \
--policy-document file://registry-policy.json
Complete Resolution Steps:
-
Add missing IAM permissions to TES role (especially iot:ListThingPrincipals)
-
Clear registry component cache:
sudo systemctl stop greengrass
sudo rm -rf /greengrass/v2/work/aws.greengrass.clientdevices.Registry
sudo systemctl start greengrass
3. Force immediate registry sync:
```bash
sudo /greengrass/v2/bin/greengrass-cli component restart \
--names aws.greengrass.clientdevices.Registry
- Monitor sync progress in logs:
sudo tail -f /greengrass/v2/logs/aws.greengrass.clientdevices.Registry.log | grep -i sync
5. Verify devices appear in local registry:
```bash
# Check registry database
sudo sqlite3 /greengrass/v2/work/aws.greengrass.clientdevices.Registry/registry.db \
"SELECT * FROM devices;"
- Test device connectivity through Greengrass:
# From client device, attempt connection
mosquitto_pub -h greengrass-core-ip -p 8883 \
--cert device.crt --key device.key --cafile root-ca.pem \
-t test/topic -m "test message"
**Key Insights:**
- The registry component requires specific IAM permissions beyond basic Greengrass operations
- Network connectivity must include both control plane (iot.region) and data plane (data.iot.region) endpoints
- Registry cache can become corrupted during reboots, requiring manual cleanup
- Credential refresh requires Greengrass restart after IAM policy updates
After applying these fixes, registry sync should complete within 5 minutes and newly registered devices will appear in the Greengrass local registry for remote management.