What can be achieved by AttachThingPrincipal API when used with Cognito Identity?

Question

Hi,

It is not quite clear in the documentation what can be achieved by using "AttachThingPrincipal" API with Cognito Identity.
I know that by calling "AttachPolicy", I can attach IoT Policy to Cognito Identity to give it access to IoT Core.

Regarding "AttachThingPrincipal" the documentation states that:

> You can use the AttachThingPrincipal API to attach certificates and authenticated Amazon Cognito identities to a thing. iot:Connection.Thing.ThingName is a useful thing policy variable to enforce client ID restrictions.

Does this mean that after attaching Cognito Identity to a Thing by using "AttachThingPrincipal" API, the Identity will be mapped to this Thing and ${iot:Connection.Thing.ThingName} set in policy attached to Cognito Identity will be resolved as Thing Name?

Accepted Answer

Yes, your understanding is correct. In order to be able to use the [Thing Policy variables](https://docs.aws.amazon.com/iot/latest/developerguide/thing-policy-variables.html) in the AWS IoT Policies, the principal (certificate or Cognito Identity) must have been associated with a Thing.

What can be achieved by AttachThingPrincipal API when used with Cognito Identity?

Contenuto pertinente