将设备连接到 AWS IOT 时出错/失败答案

【问题标题】：Error/failure with connection device to AWS IOT将设备连接到 AWS IOT 时出错/失败
【发布时间】：2021-06-17 00:00:48
【问题描述】：

我对 web 和 stackoverflow 进行了研究，但没有找到解决方案。我在将设备 MOXA 5105 与 AWS 连接时遇到问题。设备发布数据like here

我在 AWS 上看到了该连接，但在测试客户端中我没有看到 JSON。在 CloudWatch 日志中我看到了这个：

{
    "timestamp": "2021-06-16 06:09:48.771",
    "logLevel": "ERROR",
    "traceId": "XXXXXX-ebb3-XXXX-XXXXX-XXXXXXXXXXX",
    "accountId": "XXXXXXXXXXXX",
    "status": "Failure",
    "eventType": "Publish-In",
    "protocol": "MQTT",
    "topicName": "MGate_5105_Test",
    "clientId": "MGate_5105_Test",
    "principalId": "CERTIFICATCODEXXXX",
    "sourceIp": "5.226.117.166",
    "sourcePort": 55194
}

我在 AWS IOT 中编写的政策如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:client/MGate_5105_Test"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:topic/#"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:topic/MGate_5105_Test/#"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:topicfilter/MGate_5105_Test/#"
    },
    {
      "Effect": "Allow",
      "Action": "iot:UpdateThingShadow",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:thing/MGate_5105_Test"
    },
    {
      "Effect": "Allow",
      "Action": "iot:GetThingShadow",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:thing/MGate_5105_Test"
    },
    {
      "Effect": "Allow",
      "Action": "iot:DeleteThingShadow",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:thing/MGate_5105_Test"
    }
  ]
}

其中 clientID=事物名称以使其更简单

【问题讨论】：

标签： amazon-web-services mqtt aws-iot

【解决方案1】：

对于 iot:Publish 和 iot:Receive 操作，Resource 部分不支持 MQTT 通配符（+ 和 #）。

    ...
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:topic/#"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:topic/MGate_5105_Test/#"
    },
    ...

相反，您可以使用* 通配符来匹配这些操作的多个主题。

    ...
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:topic/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:eu-central-1:XXXXXXXXXXXXXX:topic/MGate_5105_Test/*"
    },
    ...

见Example policies for MQTT clients。

【讨论】：