Encryption in transit - AWS IoT Greengrass

Encryption in transit

AWS IoT Greengrass has three modes of communication where data is in transit:

Data in transit over the internet

AWS IoT Greengrass uses Transport Layer Security (TLS) to encrypt all communication over the internet. All data sent to the AWS Cloud is sent over an TLS connection using MQTT or HTTPS protocols, so it is secure by default. AWS IoT Greengrass uses the AWS IoT transport security model. For more information, see Transport security in the AWS IoT Core Developer Guide.

Data in transit over the local network

AWS IoT Greengrass uses TLS to encrypt all communication over the local network between the Greengrass core and connected Greengrass devices. For more information, see Supported Cipher Suites for Local Network Communication.

It is your responsibility to protect the local network and private keys.

For Greengrass core devices, it's your responsibility to:
For connected devices, it's your responsibility to:
  • Keep the TLS stack up to date.

  • Protect private keys.

Data on the core device

AWS IoT Greengrass doesn't encrypt data exchanged locally on the Greengrass core device because the data doesn't leave the device. This includes communication between user-defined Lambda functions, connectors, the AWS IoT Greengrass Core SDK, and system components, such as stream manager.