Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Creating robomaker resources using the CLI
#!/bin/bash
set -e
echo "Enter the robot's serial number (ex. FX250123)"
read ROBOT_SN
if [ -z $ROBOT_SN ]
then
echo "A robot serial number is required."
exit
fi
THING_NAME=$ROBOT_SN-thing # thing name is used in AWS IoT
THING_GROUP=$ROBOT_SN-group # for greegrass group
THING_POLICY=$ROBOT_SN-policy # for greengrass policy
THING_CORE=$ROBOT_SN-core # for greengrass core
IOT_GROUP_NAME=<first_group_name>
IOT_GROUP_ARN=<name_of_first_group>
echo "Enter the customer's name (if no customer, leave blank)."
read CUSTOMER
if [ -z $CUSTOMER ]
then
CUSTOMER=Discovery
fi
TODAY=$(date '+%Y-%m-%d') # used as a thing attribute (optional)
ARCH=X86_64 # architecture of robot (can be ARMHF, ARM64, or X86_64)
ROLE_ARN=<your_role_arn> # the deployment role, assumes its already created (https://docs.aws.amazon.com/robomaker/latest/dg/create-robot.html#create-robot-role)
FLEET_ARN=<your_fleet_arn> # the fleet ARN that you want your robot to be initialized into
# ----------------------------------------------------------------------------------------
# Setup Environment
# This makes an output for your greengrass certs/config that go on the robot. PRefixed by the
# robot name so that you can make multiple robots at once.
# ----------------------------------------------------------------------------------------
mkdir -p robots/$ROBOT_SN/certs
mkdir -p robots/$ROBOT_SN/config
# ----------------------------------------------------------------------------------------
# IoT: createKeysAndCertificate
# returns: certificateArn, certificateId, certificatePem, keyPair (PublicKey, PrivateKey)
# ----------------------------------------------------------------------------------------
CERTS_RESPONSE=$(aws iot create-keys-and-certificate \
--set-as-active \
--certificate-pem-outfile robots/$ROBOT_SN/certs/$ROBOT_SN.cert.pem \
--public-key-outfile robots/$ROBOT_SN/certs/$ROBOT_SN.public.key \
--private-key-outfile robots/$ROBOT_SN/certs/$ROBOT_SN.private.key | jq -r '.')
CERT_ARN=$(echo $CERTS_RESPONSE | jq -r '.certificateArn')
CERT_ID=$(echo $CERTS_RESPONSE | jq -r '.certificateId')
if [ ! -z $CERT_ID ]
then
echo "A new set of certs was created with ID $CERT_ID"
else
echo "Certs could not be created."
exit
fi
# ----------------------------------------------------------------------------------------
# Download the root CA
# ----------------------------------------------------------------------------------------
wget -O robots/$ROBOT_SN/certs/root.ca.pem sudo wget -O root.ca.pem https://www.amazontrust.com/repository/AmazonRootCA1.pem
# ----------------------------------------------------------------------------------------
# IoT: createThing
# returns: thingName, thingArn, thingId
# ----------------------------------------------------------------------------------------
THING_ARN=$(aws iot create-thing \
--thing-name $THING_NAME \
--thing-type-name FX250_Chassis \
--attribute-payload "{\"attributes\": {\"customer\":\"$CUSTOMER\", \"date_provisioned\":\"$TODAY\", \"softwareVersion\":\"0.0.0\"}}" | jq -r '.thingArn')
if [ ! -z $THING_ARN ]
then
echo "A new thing was created for $THING_NAME"
else
echo "Thing thing could not be created. Rolling back."
aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
aws iot delete-certificate --certificate-id $CERT_ID
exit
fi
# ----------------------------------------------------------------------------------------
# IoT: attachThingPrincipal
# returns: {}
# ----------------------------------------------------------------------------------------
aws iot attach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
# ----------------------------------------------------------------------------------------
# IoT: createPolicy (name: <robo_name>-policy)
# returns: policyArn, policyDocument, policyName, policyVersionId
# ----------------------------------------------------------------------------------------
POLICY_DETAILS=$(aws iot create-policy \
--policy-name $THING_POLICY \
--policy-document "{\"Version\": \"2012-10-17\",\"Statement\": [{\"Effect\": \"Allow\",\"Action\": [\"iot:Publish\",\"iot:Subscribe\",\"iot:Connect\",\"iot:Receive\"],\"Resource\": [\"*\"]},{\"Effect\": \"Allow\",\"Action\": [\"iot:GetThingShadow\",\"iot:UpdateThingShadow\",\"iot:DeleteThingShadow\"],\"Resource\": [\"*\"]},{\"Effect\": \"Allow\",\"Action\": [\"greengrass:*\"],\"Resource\": [\"*\"]}]}" | jq -r '.')
POLICY_ARN=$(echo $POLICY_DETAILS | jq -r '.policyArn')
if [ ! -z $POLICY_ARN ]
then
echo "A new policy called $THING_POLICY was created."
else
echo "Policy could not be created. Rolling back."
aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
aws iot delete-certificate --certificate-id $CERT_ID
aws iot delete-thing --thing-name $THING_NAME
aws iot delete-policy --policy-name $THING_POLICY
exit
fi
# ----------------------------------------------------------------------------------------
# # IoT: attachPolicy
# # returns: nothing
# ----------------------------------------------------------------------------------------
aws iot attach-policy --policy-name $THING_POLICY --target $CERT_ARN
# ----------------------------------------------------------------------------------------
# Greengrass: createGroup
# ----------------------------------------------------------------------------------------
GG_GRP_ID=$(aws greengrass create-group --name $THING_GROUP| jq -r '.Id')
if [ ! -z $GG_GRP_ID ]
then
echo "The group ID is $GG_GRP_ID"
else
echo "The group ID wasn't set."
aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
aws iot delete-certificate --certificate-id $CERT_ID
aws iot detach-policy --policy-name $THING_POLICY --target $CERT_ARN
aws iot delete-policy --policy-name $THING_POLICY
aws iot delete-thing --thing-name $THING_NAME
exit
fi
# ----------------------------------------------------------------------------------------
# Greengrass: associateRole to group
# assign role so group can access robomaker
# ----------------------------------------------------------------------------------------
RESPONSE=$(aws greengrass associate-role-to-group --group-id $GG_GRP_ID --role-arn $ROLE_ARN | jq --raw-output '.AssociatedAt')
if [ ! -z $RESPONSE ]
then
echo "The group was associated with the role at $RESPONSE"
else
echo "The group could not be associated with this role. Rolling back."
aws greengrass delete-role --group-id $GG_GRP_ID
exit
fi
# ----------------------------------------------------------------------------------------
# Greengrass: createCoreDefinition
# returns Name, Id, Arn, CreationTimestamp, LastUpdatedTimestamp
# ----------------------------------------------------------------------------------------
CORE_ID=$(aws greengrass create-core-definition --name $THING_CORE | jq -r '.Id')
if [ ! -z $CORE_ID ]
then
echo "The core was created with core ID $CORE_ID"
else
echo "The core could not be created. Rolling back."
aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
aws iot detach-policy --policy-name $THING_POLICY --target $CERT_ARN
aws iot delete-policy --policy-name $THING_POLICY
aws iot delete-certificate --certificate-id $CERT_ID
aws iot delete-thing --thing-name $THING_NAME
aws greengrass delete-group --group-id $GG_GRP_ID
aws greengrass delete-role --group-id $GG_GRP_ID
exit
fi
# ----------------------------------------------------------------------------------------
# Greengrass: createCoreDefinitionVersion
# returns Arn, Version, CreationTimestamp, Id
# ----------------------------------------------------------------------------------------
CORE_DEFINITION_VERSION_ARN=$(aws greengrass create-core-definition-version \
--core-definition-id $CORE_ID \
--cores CertificateArn=$CERT_ARN,Id=$CORE_ID,SyncShadow=true,ThingArn=$THING_ARN | jq -r '.Arn')
if [ ! -z $CORE_DEFINITION_VERSION_ARN ]
then
echo "The core definition version was created with ARN $CORE_DEFINITION_VERSION_ARN"
else
echo "The core definition version could not be created. Rolling back."
aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
aws iot detach-policy --policy-name $THING_POLICY --target $CERT_ARN
aws iot delete-policy --policy-name $THING_POLICY
aws iot delete-certificate --certificate-id $CERT_ID
aws iot delete-thing --thing-name $THING_NAME
aws greengrass delete-group --group-id $GG_GRP_ID
aws greengrass delete-role --group-id $GG_GRP_ID
aws greengrass delete-core-definition --core-definition-id $CORE_ID
exit
fi
# ----------------------------------------------------------------------------------------
# Greengrass: createGroupVersion
# returns Arn, Id, Version, CreationTimestamp
# ----------------------------------------------------------------------------------------
GROUP_VERSION_ARN=$(aws greengrass create-group-version \
--core-definition-version-arn $CORE_DEFINITION_VERSION_ARN \
--group-id $GG_GRP_ID | jq -r '.Arn')
if [ ! -z $GROUP_VERSION_ARN ]
then
echo "The new group version was created: $GROUP_VERSION_ARN"
else
echo "The new group version could not be created. Rolling back."
aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
aws iot detach-policy --policy-name $THING_POLICY --target $CERT_ARN
aws iot delete-policy --policy-name $THING_POLICY
aws iot delete-certificate --certificate-id $CERT_ID
aws iot delete-thing --thing-name $THING_NAME
aws greengrass disassociate-role-from-group --group-id $GG_GRP_ID
aws greengrass delete-group --group-id $GG_GRP_ID
aws greengrass delete-core-definition --core-definition-id $CORE_ID
exit
fi
# ----------------------------------------------------------------------------------------
# Greengrass: create robot
# ----------------------------------------------------------------------------------------
ROBOT_DETAILS=$(aws robomaker create-robot --name $ROBOT_SN --architecture $ARCH --greengrass-group-id $GG_GRP_ID | jq -r '.')
ROBOT_ARN=$(echo $ROBOT_DETAILS | jq -r '.arn')
if [ ! -z $ROBOT_ARN ]
then
echo "The robot with ARN $ROBOT_ARN was successfully created."
else
echo "The robot could not be created. Rolling back."
aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
aws iot detach-policy --policy-name $THING_POLICY --target $CERT_ARN
aws iot delete-policy --policy-name $THING_POLICY
aws iot delete-certificate --certificate-id $CERT_ID
aws iot delete-thing --thing-name $THING_NAME
aws greengrass disassociate-role-from-group --group-id $GG_GRP_ID
aws greengrass delete-group --group-id $GG_GRP_ID
aws greengrass delete-core-definition --core-definition-id $CORE_ID
exit
fi
# ----------------------------------------------------------------------------------------
# Robomaker: assign robot to new fleet
# Assumes the fleet has already been created (I register all new ones to a new robots fleet)
# ----------------------------------------------------------------------------------------
FLEET_DETAILS=$(aws robomaker register-robot --fleet $FLEET_ARN --robot $ROBOT_ARN | jq -r '.')
FLEET_ARN=$(echo $FLEET_DETAILS | jq -r '.fleet')
if [ ! -z $FLEET_ARN ]
then
echo "The robot was successfully associated with the fleet $FLEET_ARN"
else
echo "The robot could not be associated with the fleet. Rolling back."
aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
aws iot detach-policy --policy-name $THING_POLICY --target $CERT_ARN
aws iot delete-policy --policy-name $THING_POLICY
aws iot delete-certificate --certificate-id $CERT_ID
aws iot delete-thing --thing-name $THING_NAME
aws greengrass disassociate-role-from-group --group-id $GG_GRP_ID
aws greengrass delete-group --group-id $GG_GRP_ID
aws greengrass delete-core-definition --core-definition-id $CORE_ID
aws robomaker delete-robot --robot $ROBOT_ARN
exit
fi
# ----------------------------------------------------------------------------------------
# IoT: add-thing-to-thing-group
# Returns: none
# ----------------------------------------------------------------------------------------
aws add-thing-to-thing-group \
--thing-group-name $IOT_GROUP_NAME \
--thing-group-arn $IOT_GROUP_ARN \
--thing-name $THING_NAME \
--thing-arn $THING_ARN \
--override-dynamic-groups
# ----------------------------------------------------------------------------------------
# IoT: describe-endpoint
# response: endpointAddress
# ----------------------------------------------------------------------------------------
ENDPOINT_ADDR=$(aws iot describe-endpoint --endpoint-type iot:Data-ATS | jq -r '.endpointAddress')
# ----------------------------------------------------------------------------------------
# Create config and save to robot folder
# ----------------------------------------------------------------------------------------
echo "{\"coreThing\":{\"caPath\":\"root.ca.pem\",\"certPath\":\"$ROBOT_SN.cert.pem\",\"ggHost\":\"greengrass-ats.iot.us-east-1.amazonaws.com\",\"iotHost\":\"$ENDPOINT_ADDR\",\"keepAlive\":600,\"keyPath\":\"$ROBOT_SN.private.key\",\"thingArn\":\"$THING_ARN\"},\"crypto\":{\"caPath\":\"file:///greengrass/certs/root.ca.pem\",\"principals\":{\"IoTCertificate\":{\"CertificatePath\":\"file:///greengrass/certs/$ROBOT_SN.cert.pem\",\"PrivateKeyPath\":\"file:///greengrass/certs/$ROBOT_SN.private.key\"},\"SecretsManager\":{\"PrivateKeyPath\":\"file:///greengrass/certs/$ROBOT_SN.private.key\"}}},\"managedRespawn\":false,\"runtime\":{\"allowFunctionsToRunAsRoot\":\"yes\",\"cgroup\":{\"useSystemd\":\"yes\"}}}" > robots/$ROBOT_SN/config/config.json
# # TESTING CLEANUP
# TBD make this into a function that is called on failures
# echo "Starting clean up"
# aws iot detach-thing-principal --thing-name $THING_NAME --principal $CERT_ARN
# aws iot update-certificate --certificate-id $CERT_ID --new-status INACTIVE
# aws iot detach-policy --policy-name $THING_POLICY --target $CERT_ARN
# aws iot delete-policy --policy-name $THING_POLICY
# aws iot delete-certificate --certificate-id $CERT_ID
# aws iot delete-thing --thing-name $THING_NAME
# aws greengrass disassociate-role-from-group --group-id $GG_GRP_ID
# aws greengrass delete-group --group-id $GG_GRP_ID
# aws greengrass delete-core-definition --core-definition-id $CORE_ID
# aws robomaker delete-robot --robot $ROBOT_ARN
# rm -rf $ROBOT_SN
# echo "Finished cleaning up"
@kauffmanes

This comment has been minimized.

Copy link
Owner Author

@kauffmanes kauffmanes commented Jan 16, 2020

This is a work in progress. I'm trying to figure out everything that Robomaker does when it creates a new robot. Feel free to comment additions and I'll update.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment