Why am I getting a ForbiddenException when trying to publish MQTT messages with my AWS Lambda function?

[stam0912]

How to publish to an AWS IoT mqtt topic with a node.js 16.x lambda function?

I created a lambda function which will be triggered by the AWS cloudwatch event to publish mqtt messages. In order to give the lambda function permission to publish mqtt messages, I attached the AWSIoTDataAccess policy, it should give full access to the AWS IoT messaging actions.

import AWS from "aws-sdk";
var iotdata = new AWS.IotData({
  endpoint: "xxxxxxxxxxxxxxxx.iot.amazonaws.com",
  region: "ca-central-1",
});

export async function handler(event, context) {
    /* do something */
    await requestHB(inactiveDevices);
}

async function requestHB(inactiveDevices) {
  if (inactiveDevices == null) return;
  const publishPromises = inactiveDevices.map(async (element) => {
    var params = {
      topic: "device/inactive",
      payload: JSON.stringify({ type: 0, imei: String(element.imei) }),
      qos: 0,
    };

    try {
      await iotdata.publish(params).promise();
      console.log("Message published successfully");
    } catch (error) {
      console.error("Error publishing message:", error);
    }
  });

  await Promise.all(publishPromises);
}

With the above code, I got the following error message.

2023-05-29T17:49:01.024Z 5208a53c-f0f8-409f-a64b-9e901be9aa80 ERROR Error publishing message: ForbiddenException: null at Object.extractError (/var/task/node_modules/aws-sdk/lib/protocol/json.js:61:27) at Request.extractError (/var/task/node_modules/aws-sdk/lib/protocol/rest_json.js:61:8) at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:106:20) at Request.emit (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:78:10) at Request.emit (/var/task/node_modules/aws-sdk/lib/request.js:686:14) at Request.transition (/var/task/node_modules/aws-sdk/lib/request.js:22:10) at AcceptorStateMachine.runTo (/var/task/node_modules/aws-sdk/lib/state_machine.js:14:12) at /var/task/node_modules/aws-sdk/lib/state_machine.js:26:10 at Request. (/var/task/node_modules/aws-sdk/lib/request.js:38:9) at Request. (/var/task/node_modules/aws-sdk/lib/request.js:688:12) { code: 'ForbiddenException', time: 2023-05-29T17:49:01.023Z, requestId: '0779829a-7f5d-d298-f9da-08f1b6d83753', statusCode: 403, retryable: false, retryDelay: 24.36546771452397 }

Statuscode 403 indicates that the client making the request does not have the necessary permissions to perform the operation. But I've already attached a full access policy, what am I missing?