AUTHORIZATION_FAILURE error while publishing messages from Java Client

Question

Hi,  
  
I started testing our Java Client with AWS IoT using MQTT Protocol. I read some documents, finished few hours of training sessions before attempting the POC.  
So far what i have achieved is: CONNECT, SUBSCRIBE (i get SUBACK), PING.  
When i try publishing messages, i am getting AUTHORIZATION_FAILURE failure.  
I don't think that the error is due to policy settings or certificates. Because, i am able to connect, subscribe, receive messages sent through AWS IoT Test Console.  
No other details in logs to debug further.  
Here are my policy settings:  
{  
  "Version": "2012-10-17",  
  "Statement": \[  
    {  
      "Effect": "Allow",  
      "Action": "iot:Connect",  
      "Resource": "arn:aws:iot:us-west-2:XXXXXXXXXXXX:client/${iot:ClientId}"  
    },  
    {  
      "Effect": "Allow",  
      "Action": "iot:Subscribe",  
      "Resource": "arn:aws:iot:us-west-2:XXXXXXXXXXXX:topicfilter/java-client"  
    },  
    {  
      "Effect": "Allow",  
      "Action": "iot:Receive",  
      "Resource": "arn:aws:iot:us-west-2:XXXXXXXXXXXX:topic/java-client"  
    },  
    {  
      "Effect": "Allow",  
      "Action": "iot:Publish",  
      "Resource": "arn:aws:iot:us-west-2:XXXXXXXXXXXX:topic/home-devices/router"  
    }  
  ]  
}  
  
The policy is attached to the certificate that i am using to connect to AWS IoT.  
  
Other details if it helps to answer my question.  
Protocol: **MQTT**  
Payload format: **Binary (Google Protocol Buffers)**  
Error fields:  
details		Authorization Failure  
eventType	Publish-In  
logLevel		ERROR  
protocol		MQTT  
reason		AUTHORIZATION_FAILURE  
status		Failure  
  
Note: I have not set any rules. Is it **mandatory** to set rules to consume MQTT messages in binary format and Republish the same message to other topic?  
  
Thanks,  
Mahesh

Answer

I created a rule to consume and republish the message. I am facing same AUTHORIZATION_FAILURE error.

Answer

I found the reason for failures.   
I had another policy that had a wildcard in the topic name.  
  
As per documentation:  
In a policy, the MQTT wildcard character _ is treated as a literal, not a wildcard. Attempts to subscribe to topic filters that match the pattern some/_/topic fail and cause the client to disconnect.  
  
https://docs.aws.amazon.com/iot/latest/developerguide/pub-sub-policy.html

AUTHORIZATION_FAILURE error while publishing messages from Java Client

Relevanter Inhalt