AWS IoT - 使用 paho-mqtt 的连接和发布操作不起作用

Question

尝试使用 AWS IoT，我有以下昨天可以使用的代码：

import paho.mqtt.client as mqtt
import ssl, random
from time import sleep

mqtt_url = "XXXXXXXX.iot.us-east-2.amazonaws.com"
root_ca = './certs/iotRootCA.pem'
public_crt = './certs/deviceCert.crt'
private_key = './certs/deviceCert.key'

connflag = False

def on_connect(client, userdata, flags, response_code):
    global connflag
    connflag = True
    print("Connected with status: {0}".format(response_code))

def on_publish(client, userdata, mid):
    print userdata + " -- " + mid
    #client.disconnect()

if __name__ == "__main__":
    print "Loaded MQTT configuration information."
    print "Endpoint URL: " + mqtt_url
    print "Root Cert: " + root_ca
    print "Device Cert: " + public_crt
    print "Private Key: " + private_key

    client = mqtt.Client()
    client.tls_set(root_ca,
                   certfile = public_crt,
                   keyfile = private_key,
                   cert_reqs = ssl.CERT_REQUIRED,
                   tls_version = ssl.PROTOCOL_TLSv1_2,
                   ciphers = None)

    client.on_connect = on_connect
#    client.on_publish = on_publish

    print "Connecting to AWS IoT Broker..."
    client.connect(mqtt_url, port = 8883, keepalive=60)
    client.loop_start()
#    client.loop_forever()

    while 1==1:
        sleep(0.5)
        print connflag
        if connflag == True:
            print "Publishing..."
            ap_measurement = random.uniform(25.0, 150.0)
            client.publish("ActivePower", ap_measurement, qos=1)
            print("ActivePower published: " + "%.2f" % ap_measurement )
        else:
            print "waiting for connection..."

正如我所说，昨天这段代码正在运行。今天，我得到以下信息（没有连接）：

python awsiot-publish.py
已加载 MQTT 配置信息。
端点 URL：XXXXXXX.iot.us-east-2.amazonaws.com
根证书：./certs/iotRootCA.pem
设备证书：./certs/deviceCert.crt
私钥：./certs/deviceCert.key
连接到 AWS IoT 代理... 假的
等待连接...
假的
等待连接...
假的
等待连接... 假的

我不知道AWS IoT是否有问题...我只是认为文档不足：不清楚我们如何使用我们的代码...

Answer 1

我认为您的问题是您的证书策略没有适当的连接权限。如果未指定，paho 会生成一个随机的 client_id。您应该设置client_id。您还需要一个允许您的证书使用该客户端 ID 进行连接的策略。

{
  "Effect": "Allow",
  "Action": "iot:Connect",
  "Resource":"arn:aws:iot:us-east1:123456789012:client/yourClientIdGoesHere"
}

将您的 client_id 设置为与您的事物名称相同会​​很有用。 （但这不是必需的。）您还可以将策略中的资源设置为 *，然后使用任何 client_id 连接：

{
  "Effect": "Allow",
  "Action": "iot:Connect",
  "Resource":"*"
}