By using AWS re:Post, you agree to the Terms of Use
/How Amplify PubSub granted access to AWS IoT Core?/

How Amplify PubSub granted access to AWS IoT Core?


As my understanding, there are two required steps. I think only 1) is ok. Is this redundancy?

1) From AWS IoT core policies, grant access to cognito_identity_id

aws iot attach-policy --policy-name 'myIoTPolicy' --target '<YOUR_COGNITO_IDENTITY_ID>'

2) From Cognito side, attach AWSIoTDataAccess and AWSIoTConfigAccess to Cognito Authenticated Role

1 Answers
Accepted Answer

Hi hai. I agree that it seems like it maybe could be redundant, but it's not. You can try it yourself. If the actions are not specified for the authenticated role as well, it will fail.

When your app supports authenticated Amazon Cognito identities, in order to authenticate users, you need to specify a policy in two places. Attach an IAM policy to the authenticated Amazon Cognito Identity pool and attach an AWS IoT Core policy to the Amazon Cognito Identity.

An Amazon Cognito authenticated user needs two policies to access AWS IoT. The first policy is attached to the role of the authenticated pool to authenticate and authorize the Cognito user to communicate with AWS IoT. The second policy is attached to the authenticated Cognito user ID principal for fine-grained permissions.

answered 13 days ago
  • Thank you! but what risk if only one policy is required? why should be two?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions