Greengrass Device Registration

Device Registration

Register and provision Greengrass devices in /IOTCONNECT™. This section covers template creation, device identity, certificate management, authentication flow, and the complete registration workflow from portal to physical device.

Registration Overview

Device registration in /IOTCONNECT™ is a two-phase process:

Phase 1 — Cloud Registration (Portal)

Create a Template (defines data schema and commands)

Create a Device (generates identity, certificates, and MQTT configuration)

Download Connection Kit (certificates + installer package)

Phase 2 — Device Provisioning (Physical Device)

Transfer the connection kit to the device

Run the installer script

Device authenticates with X.509 certificates and connects

Once both phases complete, the device appears as Connected in the portal and is ready for component deployment.

Template Creation

A template is the blueprint for your Greengrass devices. It defines:

Attributes: The telemetry fields your device will send (temperature, humidity, voltage, etc.)

Commands: Actions you can trigger from the cloud (restart, set_interval, calibrate)

Settings / Twin: Desired property values you can push to the device

Rules: Conditions that trigger notifications or actions when telemetry meets criteria

How to Create a Template:

1. Navigate to Devices → Greengrass Device → Templates (bottom tab).

2. Click Create Template.

3. Fill in the required fields:

Field	Description	Example
Template Name	Descriptive name for this device type	Smart Factory Sensor
Template Code	Short unique identifier (no spaces)	factory_sensor_v1
Description	Optional notes about this template	Monitors temperature and vibration

4. Add Attributes — Click Add Attribute for each telemetry field:

Attribute Name	Data Type	Unit
Temperature	Decimal	°C
Humidity	Decimal	%
Vibration	Decimal	mm/s
Status	String	—
IsRunning	Boolean	—

5. Add Commands (optional) — Define remote actions:

Command Name	Parameter	Purpose
set_interval	seconds (Integer)	Change telemetry reporting frequency
restart	— (none)	Restart the component
calibrate	offset (Decimal)	Apply sensor calibration offset

6. Click Save.

Device Creation

Once you have a template, register your physical device:

1. Go to Devices → Greengrass Device → Devices (bottom tab).

2. Click Create Device.

3. Complete the required fields:

Field	Required	Description	Tips
Unique ID	Yes	Permanent device identifier	Use site-type-number pattern (e.g., plant1-gw-001). Cannot be changed after creation.
Display Name	Yes	Human-readable label	Can be updated later (e.g., “Factory Floor Gateway”)
Entity	Yes	Organizational unit	Select from your entity hierarchy (e.g., Building-A / Floor-2)
Template	Yes	Data schema for this device	Cannot be changed after creation
Device Type	Yes	Nucleus Classic or Nucleus Lite	Cannot be changed after creation
Notes	No	Optional description	Location, serial number, or deployment notes

4. Click Save (or Save & View).

What happens behind the scenes:

/IOTCONNECT™ creates an AWS IoT Thing with your Unique ID

An X.509 certificate pair is generated and attached to the Thing

An IoT Policy is attached granting MQTT publish / subscribe permissions

A Greengrass Core Device identity is registered

Configuration file is generated with MQTT endpoint, device metadata, and CPID

The device status shows as Released (waiting for physical device to connect).

Certificate and Authentication

Greengrass devices in /IOTCONNECT™ use X.509 certificate-based authentication — a widely adopted and highly secure IoT authentication method. No username / password or IAM credentials are stored on the device.

How authentication works:

Device Certificate: A unique X.509 certificate is issued to each device during registration. This is the device’s identity.

Private Key: Paired with the certificate. Stored only on the device — never leaves the device or is transmitted over the network.

Root CA: Amazon Root CA certificate validates the server identity during TLS handshake.

Mutual TLS: Both the device AND the server prove their identity to each other — preventing man-in-the-middle attacks.

Connection Kit Contents:

File	Purpose	Security
device.pem.crt	Device identity certificate	Can be shared (public)
private.pem.key	Private key for TLS authentication	NEVER share — device secret
AmazonRootCA1.pem	Validates AWS IoT server identity	Public (same for all devices)
config.json	MQTT endpoint, device ID, CPID	Contains non-secret metadata

Security Best Practices:

Each device must have its own unique certificate — never reuse bundles across devices.

Store the private key with restricted file permissions (chmod 600).

If a device is compromised, delete it from the portal — this immediately revokes its certificates.

Store the downloaded connection kit securely and avoid downloading or distributing unnecessary copies and transfer securely (SCP over SSH, not email).

Device Status Lifecycle

A Greengrass device transitions through these states:

Status	Meaning	Next Step
Released (Orange)	Device registered in portal, not yet provisioned	Download bundle and install on device
Connected (Green)	Device is online and communicating	Deploy components and monitor
Disconnected (Red)	Device was connected but lost communication	Check device power, network, and service status
Active	/IOTCONNECT™ status — device is enabled	Normal operation
Inactive	/IOTCONNECT™ status — device is disabled	Re-activate from portal to resume

Device List and Filtering

The Greengrass Device List shows all registered devices with key information:

Column	Description
Unique ID	Click to open device details and management tabs
Device Name	Display name (editable)
Template	Associated template name
Entity	Organizational unit
Last Connection	When the device last connected to the cloud
Last Communication	When the device last sent telemetry data
Device Status	Connected / Disconnected / Released
Status	Active / Inactive
Actions	Download bundle, Track changes, Delete

Filtering: Click the filter icon (top-right) to filter by Entity, Device Status, Template, or custom criteria. Up to 6 filters can be applied simultaneously.

ⓘ NOTE

After registration, proceed to the Quick Start guide to install the Greengrass Nucleus on your physical device, or to Package Management to prepare components for deployment.