Subscription authorization failure

[cjacky475]

Issue:

Whenever I try to subscribe to specific topic, which is allowed in the policy, I receive authorization failure (logged in CloudWatch). In my application I receive that AWS IoT connection was established, but then it ends the connection and keep reconnecting, while CloudWatch logs authorization failure.

Details:

Code in my Spring Boot application:

public void connect(String clientID) {
        AwsIotMqttConnectionBuilder builder = AwsIotMqttConnectionBuilder
                .newMtlsBuilderFromPath("src/main/resources/certificate.pem.crt", "src/main/resources/private_key.pem.key");

        ClientBootstrap clientBootstrap = new ClientBootstrap(null, null);

        MqttClientConnection clientConnection = builder
                .withConnectionEventCallbacks(callbacks)
                .withCleanSession(false)
                .withBootstrap(clientBootstrap)
                .withClientId(clientID)
                .withCertificateAuthorityFromPath(null, "src/main/resources/AmazonRootCA1.pem")
                .withEndpoint("aaaaaaaaaaaa-ats.iot.us-east-2.amazonaws.com")
                .withProtocolOperationTimeoutMs(80000)
                .build();

        try {
            boolean session = clientConnection.connect().get(TIMEOUT_SECONDS, TimeUnit.SECONDS);

            if (session) {
                logger.info("AWS IoT Core client connection established. Subscribing to all sensors topics.");

                clientConnection.subscribe("sensors/5", QualityOfService.AT_LEAST_ONCE, mqttMessage -> {
                    System.out.println("MESSAGE: " + Arrays.toString(mqttMessage.getPayload()));
                });
            } else {
                logger.warn("Could not establish AWS IoT Core client connection.");
            }
        } catch (InterruptedException | ExecutionException | TimeoutException e) {
            e.printStackTrace();
        }
    }

Policy:

Allow | iot:Connect | arn:aws:iot:us-east-2:123123123123:client/5
Allow | iot:Receive | arn:aws:iot:us-east-2:123123123123:topic/sensors/5
Allow | iot:Subscribe | arn:aws:iot:us-east-2:1231231231231:topicFilter/sensors/5

[jmklix]

It sounds like a policy issue and I would recommend using a fully permissive policy for testing:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

And once you get it working look at these docs and limit your policy to only what you need.

[cjacky475]

I found the problem:

The correct subscription policy should be as follows:
Allow | iot:Subscribe | arn:aws:iot:us-east-2:1231231231231:topicfilter/sensors/5

I wrote topicFilter instead of topicfilter.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.