Integrate Cognito with IoT core

It seems like you've set up most of the necessary components correctly, but you're missing a crucial step in the integration of Cognito with IoT Core. Even though you have the correct IAM permissions attached to your Cognito Identity Pool role, you still need to attach an AWS IoT policy to the authenticated Cognito identity.

Here's what you need to do:

1. Create an AWS IoT policy that defines the permissions for your IoT operations. This policy should include permissions for connecting, publishing, and subscribing as needed for your application.

2. After a user authenticates through Cognito and you obtain the Cognito Identity ID, you need to attach the IoT policy to this identity. You can do this using the AWS IoT Core AttachPolicy API.

Here's a general outline of the process in Python:

import boto3

# Assume you have already authenticated the user and obtained Cognito credentials

# Create an IoT client using the Cognito credentials
iot_client = boto3.client('iot', region_name='your-region', 
aws_access_key_id=credentials['AccessKeyId'],
aws_secret_access_key=credentials['SecretKey'],
aws_session_token=credentials['SessionToken'])

# Attach the IoT policy to the Cognito Identity
iot_client.attach_policy(
policyName='YourIoTPolicyName',
target=cognito_identity_id
)

After attaching the policy, your authenticated Cognito user should be able to connect to IoT Core via MQTT over WebSocket.

Remember to create an appropriate IoT policy that grants the necessary permissions for your use case. The policy should allow actions like 'iot:Connect', 'iot:Publish', 'iot:Subscribe', and 'iot:Receive' on the appropriate resources.

If you're still encountering issues after attaching the IoT policy, double-check your IoT policy to ensure it grants the correct permissions, and verify that you're using the correct IoT endpoint for your region when attempting to connect.
Sources
Amazon Cognito identities - AWS IoT Core
Authorization with Amazon Cognito identities - AWS IoT Core
Connecting and Authenticating Automotive iOS App to AWS IoT Core | AWS for Industries