AWS IoT Rule to send MQTT message to DynamoDB not working

Question

Hello,

I am sending data using MQTT test client in AWS IoT. The data is showing up properly when I subscribe to the topic. I then wanted to send the data to DynamoDB using a rule. I created the rule and double checked everything: made sure the topics were the same, the rule and MQTT were in the same location (ie: u-west-1), i tried creating different roles when the first didn't work, and i double checked to make sure the attributes were spelled correctly in the MQTT message and DynamoDB table. Any help or additional troubleshooting methods will be greatly appreciated. Thanks.

Accepted Answer

I needed to add the "AWSIoTRuleAction" permission to the role. It is working properly now. Thanks for everyone's help

Answer

It is possible the IoT rule does not have the proper permissions to send to DynamoDB. See this documentation page on Granting an AWS IoT rule the access it requires.

The user also requires the iam:PassRole permission to pass the role to the rules engine. You can see directions on how to create the permissions in the documentation page on Pass role permissions.

The user also requires the `iam:PassRole` permission to pass the role to the rules engine. You can see directions on how to create the permissions in the documentation page on [Pass role permissions](https://docs.aws.amazon.com/iot/latest/developerguide/pass-role.html).

Answer

Here is how I did it.

1. Create a role with a policy to allow writting to DyanamoDB. 
```json 
const role = new aws_iam.Role(
      this,
      'RoleForIoTCoreToAccessDDB,
      {
        roleName: 'RoleForIoTCoreToAccessDDB',
        assumedBy: new aws_iam.ServicePrincipal('iot.amazonaws.com')
      }
    )
```
attach an inline policy
```
role.attachInlinePolicy(
      new aws_iam.Policy(
        this,
        'PolicyForIoTcoreToAccessDDB',
        {
          policyName: 'PolicyForIoTcoreToAccessDDB',
          statements: [
            new aws_iam.PolicyStatement(
              {
                actions: ['dynamodb:*'],
                resources: ['*']
              }
            )
          ]
        }
      )
    )
```

2. Attach the role to an IoT topic rule 
```json
const topicRule = new aws_iot.CfnTopicRule(
      this,
      'TopicRuleDemo',
      {
        ruleName: 'TopicRuleDemo',
        topicRulePayload: {
          actions: [
            {
              dynamoDb: {
                hashKeyField: 'id',
                hashKeyValue: 'device01',
                hashKeyType: 'STRING',
                rangeKeyField: 'timestamp',
                rangeKeyValue: '${timestamp()}',
                rangeKeyType: 'STRING',
                roleArn: role.roleArn,
                tableName: table.tableName
              }
            }
          ],
          sql: `SELECT *, cast(timestamp() as STRING) AS timestamp FROM 'topic/subtopic'`
        }
      }
    )
```

[GitHub Code](https://github.com/entest-hai/aws-iot-demo)

Answer

If you haven't, enable logging for AWS IoT Core. When the rule execution fails you will find the reason in CloudWatch logs.

BTW: the region name u-west-1 is not valid, it is us-west-1.

KR,
Philipp

AWS IoT Rule to send MQTT message to DynamoDB not working

Relevant content