AWS IoT：ForbiddenException：在浏览器中尝试 iotData.getThingShadow() 时被禁止

Question

我正在处理使用 Federated Cognito 凭据（Facebook 登录）上传到 EC2 到 getThingShadow() 的浏览器脚本，但只得到 ForbiddenException: Forbidden

登录部分成功，我从 AWS.WebIdentityCredentials() 收到凭据（非空）

使用 CLI 手动授权 cognito ID (aws iot attach-principal-policy) Cognito_Auth_Rule 也允许 iot:*

看起来我按照手册做了一切，仍然无法获取 iotData

http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/IotData.html

请指教，非常感谢任何cmets

谢谢

尼克

我附加到 Cognito_Auth_Rule 的 IAM 政策是：

            {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Action": [
                            "iot:*"
                        ],
                        "Resource": [
                            "*"
                        ]
                    }
                ]
            }

获取凭证

iotData.config.credentials = new AWS.WebIdentityCredentials({
    ProviderId: 'graph.facebook.com',
    RoleArn: roleArn,
    WebIdentityToken: response.authResponse.accessToken
});

我的代码

        var params = {
            thingName: 'thingName' /* required */
        };
        iotdata.getThingShadow(params, function (err, data) {
            if (err) {
                console.log(err, err.stack); // an error occurred
                iotResults.innerHTML = err;
            } else {
                console.log(data);           // successful response
                iotResults.innerHTML = data;
            }
        });

来自控制台的错误消息：

Error: Forbidden
    at Object.s [as extractError] (aws-sdk-2.7.20.min.js:37)
    at constructor.i (aws-sdk-2.7.20.min.js:37)
    at constructor.callListeners (aws-sdk-2.7.20.min.js:38)
    at constructor.emit (aws-sdk-2.7.20.min.js:38)
    at constructor.emitEvent (aws-sdk-2.7.20.min.js:37)
    at constructor.e (aws-sdk-2.7.20.min.js:37)
    at a.runTo (aws-sdk-2.7.20.min.js:39)
    at aws-sdk-2.7.20.min.js:39
    at constructor.<anonymous> (aws-sdk-2.7.20.min.js:37)
    at constructor.<anonymous> (aws-sdk-2.7.20.min.js:37) "ForbiddenException: Forbidden
    at Object.s [as extractError] (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:37:9704)
    at constructor.i (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:37:14284)
    at constructor.callListeners (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:38:4687)
    at constructor.emit (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:38:4396)
    at constructor.emitEvent (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:37:23801)
    at constructor.e (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:37:19651)
    at a.runTo (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:39:11367)
    at https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:39:11574
    at constructor.<anonymous> (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:37:19861)
    at constructor.<anonymous> (https://sdk.amazonaws.com/js/aws-sdk-2.7.20.min.js:37:23856)"

Answer 1

IAM 策略很好...但是您需要专门为该用户设置 IoT 策略...所以当创建用户时，或者现在当用户登录时...调用

let iot = new AWS.Iot(); iot.attachPrincipalPolicy(

您应该注意到该方法收到了 policyName，即“在 IoT 策略中”的策略名称（不在 IAM 策略中，因此请在 IoT 中复制您的策略）和委托人，即 cognito 用户 ID

给出IAM策略还不够，还需要指定attachPrincipalPolicy

Answer 2

要使用 OP 使用的 iotdata.getThingShadow(); 方法通过浏览器读取 Thing Shadow，您需要附加一个 Principal Policy。

如果有人想知道，如何自动设置 UXDart 提到的 iot.attachPrincipalPolicy：

 cognitoIdentity.getId(params, function(err, data) {
        if (err) console.log(err, err.stack); // an error occurred
        else{
          cognitoId = data.IdentityId;

          console.log('Cognito ID: ' + cognitoId);

          var iot = new AWS.Iot();

          iot.listPrincipalPolicies({principal: cognitoId}, function(err, data) {
            if (err) console.log(err, err.stack); // an error occurred
            else{
              console.log(data);
              var found = false;
              for(var i = 0; i < data.policies.length; i++) {
                if (data.policies[i].policyName == 'your-iot-policy'){
                  found = true;
                  break;
                }
              }
              if(found == false){
                console.log("Versuche Policy einzutragen...")
                iot.attachPrincipalPolicy({policyName: 'your-iot-policy', principal: cognitoId}, function(err, data) {
                  if (err) console.log(err, err.stack); // an error occurred
                  else     console.log("Policy eingetragen!");           // successful response
                });
              }else console.log("Policy gefunden!");
            }
          });
        }
      });