Get Thing ID (ARN) in Lambda IoT MQTT handle

Can a Lambda action get the Thing ID (its ARN, or some way to uniquely identify it)? Is the answer different if you do or don't use basic ingestion?

I searched the forum before I asked this, one clue I found was this:

https://repost.aws/questions/QUT4KAUvqKQOS0v2Abgpxt-g/aws-io-t-thing-connected-event-find-the-thing-name-from-event

which suggest I can change the role to include:

        "Resource": [
          "arn:aws:iot:us-east-1:123456789012:client/${iot:Connection.Thing.ThingName}"
        ]

if I get the idea behind that, I could force devices to set their MQTT client id to be the same as their ThingName, and to use that I would include clientId() in the SELECT.

Is that the simplest way?

--C