command error about X-LINUX-AWS Expansion Package guide

[younghan]

Hello,

I follow this guide X-LINUX-AWS Expansion Package 

cmd) aws iot attach-policy --policy-name ${TOKEN_EXCHANGE_ROLE_ALIAS_POLICY} --target ${CERT_ARN}

but, error occurred (ResourceNotFoundException) when calling the AttachPolicy operation: Policy not found

PC)

yhlee@YoungHan:~/STM32MPU_workspace$ scp root@${BOARD_IP}:${CSR} ${CSR_ON_PC}
mykey_csr.pem 100% 899 484.7KB/s 00:00
yhlee@YoungHan:~/STM32MPU_workspace$ scp root@${BOARD_IP}:${CSR} ${CSR_ON_PC}
-certificate-from-csr --certificate-signing-request file://${CSR_ON_PC} --certificate-pem-outfile ${CERT_ON_PC} --set-as-active
scp ${CERT_ON_PC} root@${BOARD_IP}:${CERT}
mykey_csr.pem 100% 899 427.4KB/s 00:00
yhlee@YoungHan:~/STM32MPU_workspace$ aws iot create-certificate-from-csr --certificate-signing-request file://${CSR_ON_PC} --certificate-pem-outfile ${CERT_ON_PC} --set-as-active
{
"certificateArn": "arn:aws:iot:ap-northeast-2:590183762918:cert/689ea30a84b838d89f8b06458b33deee0ad11a9c348caa015ebb7f670e90f045",
"certificateId": "689ea30a84b838d89f8b06458b33deee0ad11a9c348caa015ebb7f670e90f045",
"certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDVjCCAj6gAwIBAgIUdu5Q9qTOfBtCWrzkOftybqE8/1EwDQYJKoZIhvcNAQEL\nBQAwTTFLMEkGA1UECwxCQW1hem9uIFdlYiBTZXJ2aWNlcyBPPUFtYXpvbi5jb20g\nSW5jLiBMPVNlYXR0bGUgU1Q9V2FzaGluZ3RvbiBDPVVTMB4XDTI0MDUyNDA1MTkz\nOFoXDTQ5MTIzMTIzNTk1OVowGzEZMBcGA1UEAwwQTXlHcmVlbmdyYXNzQ29yZTCC\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKqb6lXZ9xVeACsr5stecIBC\nMAhMkHVg/aASaHlo0qwcKYOkMjWwctR9mTkkqHC/90ourlYzZ5H0hvM5xVmKC1W2\nh/JdXRzLNpsEdHIEo6vn//Ud94bHt/mORkKRGvKSL4b8tU14WqQuMfgBREEbkjUQ\nXAgGYMk9L5xf4vyhEJVukbGCPH3RUUGh8OGTUFbJsIgHfVcu38XKg40b9CMnff7U\nHIzvETqqFKYbt9FACrEXum1cPMqB6yTHxyfYZ5iADSSfLAT5PRpJor73PsY1BFt+\nsbHI/tqjWy87r2rR8LG2t7ckYCCl0Uhw0/6Bu7m6HtCBulW544cj+RBTwfzR2oMC\nAwEAAaNgMF4wHwYDVR0jBBgwFoAUWdmgM1yJIAkYFxnh4+gKUv6Anb4wHQYDVR0O\nBBYEFOEE7v3cR/tbbW9EVCbZWTvarQD/MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/\nBAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IBAQCG9hA5RWIfwtG/1KumOcrP7HyqjE6N\nBdfwIc057xIbUVdQDuha32uMnf1zA0jiHaOQ4v1qNZIHZVN4MhfD07hvHCjYMMIN\nDXocdZj5yYr7ZhMkzrFP6N3F2G5NCWZ13ab0+beL5yE2s5GUmH31qeEIz4wlYIEp\nE50Ipi31+Uk7P9C9FsoANtKnkDtPLhmN/IpvKUg1DzRx1LcFPJ3ElOHyot1pzBA0\nvI4dCPWyUuyp0I/c5oeqw0exwc6RtTh5c2YgxpFmpeZUtp+zbOIf2e8msjQki4qu\np8Hzv2K+7uj3pyRoPtcXwNTUsV+0EO2+BgbAth1gj3L3HKDJt8r+g6Dv\n-----END CERTIFICATE-----\n"
}
yhlee@YoungHan:~/STM32MPU_workspace$ scp ${CERT_ON_PC} root@${BOARD_IP}:${CERT}
core.pem 100% 1216 427.6KB/s 00:00
yhlee@YoungHan:~/STM32MPU_workspace$ CERT_ARN="arn:aws:iot:ap-northeast-2:590183762918:cert/689ea30a84b838d89f8b06458b33deee0ad11a9c348caa015ebb7f670
e90f045"
yhlee@YoungHan:~/STM32MPU_workspace$ aws iot attach-thing-principal --thing-name ${GREENGRASS_CORE} --principal ${CERT_ARN}
yhlee@YoungHan:~/STM32MPU_workspace$ aws iot attach-policy --policy-name ${AWS_IOT_POLICY} --target ${CERT_ARN}
yhlee@YoungHan:~/STM32MPU_workspace$ aws iot attach-policy --policy-name ${TOKEN_EXCHANGE_ROLE_ALIAS_POLICY} --target ${CERT_ARN}

An error occurred (ResourceNotFoundException) when calling the AttachPolicy operation: Policy not found

yhlee@YoungHan:~/STM32MPU_workspace$

[AMARSTM · Accepted solution]

Hello @younghan,

As mentioned in X-LINUX-AWS (section AWS IoT and IAM resources configuration) you must have create several resources on AWS, especially a Token Exchange Role Alias Policy.

It seems that this resource has not been created. You can follow the steps of greengrass v2 create-token-exchange-role 

All the steps need to be done

1.  Create an IAM role...
   1. Create a file that contain...
   2. Create the token exchange role...
   3. Create a file that contains...
   4. Create the IAM policy...
   5. Attach the IAM policy...
2. Create an AWS IoT role alias...
3. Create and attach an AWS IoT policy...
   1. (Optional) Create a file that contains the AWS IoT policy...
   2. Create an AWS IoT policy...
   3. Attach the AWS IoT policy...

Finally you command

aws iot attach-policy --policy-name GreengrassCoreTokenExchangeRoleAliasPolicy --target arn:aws:iot:us-west-2:123456789012:cert/aa0b7958770878eabe251d8a7ddd547f4889c524c9b574ab9fbf65f32248b1d4

 should work. 

Best regards,