Issue when trying to set no permissive policy MQTIos iot core

Question

Hi all,
I build a system with nrf sdk and nRF9151 chip. I created a thing in aws iot core, create certs and attach policy, for my first test I use a very permissive policy
````
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    }
  ]
}
````
So to be cut I've followed [this tutorial from nordic](https://docs.nordicsemi.com/bundle/ncs-2.4.2/page/nrf/libraries/networking/aws_iot.html#setup-aws-and-permissions), everything work, I'm able to connect, subscride, publish etc.

But for now I'd like to create no permissive policy, but despite all my attempts I cannot get my system to work. 
What I want to do:
 - be able to subscribe to topics like /TOP/359404230604599/*
 - be able to receive to topics like /TOP/359404230604599/*
 - be able to connect with clientID 359404230604599 (same as my thing name)

here is what I've tried
````
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:eu-west-3:removed:topic/TOP/359404230604599/"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "arn:aws:iot:eu-west-3:removed:topicfilter/TOP/359404230604599/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": "arn:aws:iot:eu-west-3:removed:topic/TOP/359404230604599/*"
    }
  ]
}
````
 
It's doesn't work, it's look like as soon as I add something behind topic/ or topicfilter other than `*`I'm blocked...

What I miss ?

Thanks

re:Post Agent · Answer

When creating a less permissive policy for AWS IoT Core, there are a few key points to consider:

1. Client ID restriction: To ensure that only the specific device can connect, you should restrict the iot:Connect action to use the thing name as the client ID. This can be done using the ${iot:Connection.Thing.ThingName} policy variable.

2. Topic structure: Make sure your topic structure in the policy exactly matches what your device is trying to publish to or subscribe to. The wildcard (*) at the end allows for subtopics.

3. Resource ARNs: Ensure that your account ID and region are correct in the resource ARNs.

Based on your requirements, here's a suggested policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "arn:aws:iot:eu-west-3:YOUR_ACCOUNT_ID:client/${iot:Connection.Thing.ThingName}",
      "Condition": {
        "StringEquals": {
          "iot:ClientId": "${iot:Connection.Thing.ThingName}"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:eu-west-3:YOUR_ACCOUNT_ID:topic/TOP/${iot:Connection.Thing.ThingName}/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "arn:aws:iot:eu-west-3:YOUR_ACCOUNT_ID:topicfilter/TOP/${iot:Connection.Thing.ThingName}/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": "arn:aws:iot:eu-west-3:YOUR_ACCOUNT_ID:topic/TOP/${iot:Connection.Thing.ThingName}/*"
    }
  ]
}
```

This policy:
1. Restricts the Connect action to only allow connections with a client ID matching the thing name.
2. Allows publishing, subscribing, and receiving on topics that start with "/TOP/[ThingName]/" and can have any subtopics after that.
3. Uses the ${iot:Connection.Thing.ThingName} variable to dynamically insert the thing name into the topic structure.

Make sure to replace YOUR_ACCOUNT_ID with your actual AWS account ID.

If you're still experiencing issues after applying this policy, double-check that:
1. The thing name in AWS IoT Core exactly matches the client ID your device is using to connect.
2. The topic structure in your device code matches what's specified in the policy.
3. The certificate associated with the thing is activated and properly attached to both the thing and this policy.

Remember, when using the ${iot:Connection.Thing.ThingName} variable, the client ID used to connect must exactly match the thing name for the policy to work correctly.  
**Sources**  
[Policy Thing Problem | AWS re:Post](https://repost.aws/questions/QUHfHgk6BSSyi5_PPfL-ZvTA/policy-thing-problem)  
[New needed IoT publish permissions from Lambda | AWS re:Post](https://repost.aws/questions/QUICdJNcwhTsSAxvpEpfmLgw/new-needed-iot-publish-permissions-from-lambda)

MassimilianoAWS · Answer

The policy provided in the AI generated answer is correct for what you want to achieve, assuming the clientId passed used by the code on the device is exactly the same as the thing name.

The error you published is related to the connection attempt. Could you confirm that if you change the first statement to 
```
{
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "*"
    }
```

you get a different error?

Issue when trying to set no permissive policy MQTIos iot core

Relevant content