IoT Policy works on certificate but not on group?

Question

Im doing some basic MQTT coding.
I have a simple policy below:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "*"
    }
  ]
}

```

It works great when I attact it to the certificate of my Thing.
But... when I instead attach it to a thing group, and assign the Thing into that group...
it has no effect.
I've tried waiting a minute or two, but no workie.
Meanwhile, when I then assign it to the certificate again... it works immediately!

I'm confused. Why doesnt assigning IoT policy permissions through thing groups work?

rePost-User-8804953 · Accepted Answer

It turns out that for some reason, If you connect with a "client_id" that is random, you will only get Policies applied, that are directly associated with the certificate you use to connect. So you can use a client_id of whatever you want, in the case where you are directly associating policies.

To take advantage of groups, you MUST use a client_id that exactly matches the thing-name that your cert is associated with.

Philipp S · Answer

Hi,

did you try to [list the effective policies](https://docs.aws.amazon.com/iot/latest/developerguide/thing-groups.html) for your thing? This could help to debug this issue.

Did you use a static thing group? Dynamic thing groups to not support attaching policies to the group.

There is a chapter about thing groups in the [IoT Device Management workshop](https://catalog.us-east-1.prod.workshops.aws/workshops/7c2b04e7-8051-4c71-bc8b-6d2d7ce32727/en-US/thing-groups/static-thing-groups) which might help.

Cheers,  
Philipp

IoT Policy works on certificate but not on group?

Relevant content