- Newest
- Most votes
- Most comments
Yes, your understanding is correct. In order to be able to use the Thing Policy variables in the AWS IoT Policies, the principal (certificate or Cognito Identity) must have been associated with a Thing.
I've encountered an issue: After using AttachThingPrincipal to bind the Cognito user ID with a thing name, when the app initiates an MQTT topic subscription, it must use this thing name (client ID). Currently, our thing name is similar to the device-side client ID. In this situation, when the device side initiates a topic subscription, it can't use this client ID anymore. If it continues to use the thing name (client ID), it will kick off the app's MQTT subscription events. Are we using it incorrectly, or is there something we've misunderstood?
"But I just want to make a Cognito user able to only see the topics uploaded by the device it is bound to, and not be able to subscribe to or see other topics."
This is separate problem, so you should start a new question instead of asking a question in an answer box - you'd reach more people able to answer to you.
But regardless - what you can do is:
- Create IoT policy that will limit actions to topics specific for your device
- Attach this policy to device certificate
- Use AttachPolicy API to attach this policy to your Cognito identity
If you want this solution to be scalable and keep track of which Cognito user owns which device, you'd have to back it up with some automation and storage backend (Lambda, fleet provisioning, DynamoDB, API Gateway) depending on your use case, otherwise for testing or single use you can do it using AWS CLI or console.
This may be a good lecture to start with: https://aws.amazon.com/blogs/iot/scaling-authorization-policies-with-aws-iot-core/
What is the correct approach to limiting a Cognito user to only specific IOT things?
Relevant content
asked 4 years ago- asked 2 years ago
- AWS OFFICIALUpdated 3 years ago
This is expected behaviour. You cannot have the same multiple MQTT client IDs connecting to IoT at the same time. You could name your device client <ThingName> but you'd have to name your app client for example <ThingName-App-GUID>. You could use AttachPolicy API to attach Cognito identity to your IoT policy and handle permissions there (i.e. allow connections to <ThingName*>). Using AttachThingPrincipal makes it possible to use policy variables (i.e. evaluate client id for connections) but you still must obey the requirement to have unique client IDs.