Setup

I have system in which there are multiple services running and all of them need to connect to one single thing. The clientID of my main service is the thingName itself. However, the ClientID for my other services look like thingName-jobs, thingName-test etc. What I would like to achieve is to create a policy which lets these services connect, and subscribe and publish to topics restricted by thingName.

Problem

Connect

My problem is, in the policy, inside iot:connect, only services with clientID as thingName can connect even though I have let all services clientID present.

{
    "Effect": "Allow",
    "Action": "iot:Connect",
    "Resource": [
        "arn:aws:iot:eu-west-2:000000000000/${iot.Thing.ThingName}",
        "arn:aws:iot:eu-west-2:000000000000/${iot.Thing.ThingName}-jobs",
        "arn:aws:iot:eu-west-2:000000000000/${iot.Thing.ThingName}-test",
        ]
}

Here, thingName-jobs and thingName-test connections are getting refused.

Subscribe

{
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": [
        "arn:aws:iot:eu-west-2:000000000000:topicfilter/*/${iot:Connection.Thing.ThingName}/*",
        "arn:aws:iot:eu-west-2:000000000000:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*"
      ]
    },

Here, clients with clientID != thingName cannot subscribe to these topics.

Publish

Same goes for publish.

{
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": [
        "arn:aws:iot:eu-west-2:000000000000:topic/*/${iot:Connection.Thing.ThingName}/*",
        "arn:aws:iot:eu-west-2:000000000000:topic/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*"
      ]
    },

I know using certificate variables is an option, but some of these devices are already on site and I don't have the option to create/change their certificates. I need a policy which restricts clients to connect, publish and subscribe to topics restricted by thingName. Is this possible without using certificate variables or wildcards.