The error you're encountering is likely due to a mismatch between the permissions granted in your IAM policy and the way you're trying to publish the message. There are a few issues to address:

1. Authentication method: In your Python script, you're using AWS access keys directly. This method is typically used for AWS CLI or SDK access, not for IoT device communication. IoT devices usually use X.509 certificates for authentication.

2. Policy structure: Your policy is attached to the Thing certificate, but you're not using the certificate in your code. Instead, you're using IAM credentials.

3. Connect permission: In your policy, the "iot:Connect" action is incorrectly associated with a topic resource. It should be associated with a client resource.

To resolve these issues:

1. If you're testing device communication, use the appropriate IoT SDK and X.509 certificates instead of IAM credentials.

2. If you must use IAM credentials (not recommended for production IoT devices), ensure the IAM user or role has the necessary IoT permissions.

3. Modify your policy to correctly allow connections. Change the "iot:Connect" action to use a client resource, not a topic resource. For example:

   {
     "Effect": "Allow",
     "Action": "iot:Connect",
     "Resource": "arn:aws:iot:us-east-1:********:client/${iot:Connection.Thing.ThingName}"
   }

4. Ensure your IAM user or role has permissions to use the iot-data client if you continue using this method.

The Colab environment itself is not likely the source of the problem. The issue is more related to the authentication method and permission configuration. For IoT device testing, it's recommended to use the appropriate IoT device SDK and certificate-based authentication rather than IAM credentials in a Colab notebook.
Sources
Publish/Subscribe policy examples - AWS IoT Core
Connect and publish policy examples - AWS IoT Core