Android 中的 AWS IoT Policy 不适用于自定义主题

Question

I am using AWS android SDK to connect to AWS IoT. The following policy allow my app to successfully connect to AWS IoT except when i make this change

"Resource": "arn:aws:iot:us-west-2:1234567890xxx:topic/topic1" I have tried almost every possible custom option but the policy works only for "*" wild card that means "any resource and/or any topics".

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iot:Connect",
             "Resource": "arn:aws:iot:us-west-2:1234567890xxx:client/mobile-client-master"
        },
        {
            "Effect": "Allow",
            "Action": [
            "iot:Publish",
            "iot:Subscribe",
            "iot:Receive"
            ],
            "Resource": "*" 
        }
     ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iot:Connect",
             "Resource": "arn:aws:iot:us-west-2:1234567890xxx:client/mobile-client-master"
        },
        {
            "Effect": "Allow",
            "Action": [
            "iot:Publish",
            "iot:Subscribe",
            "iot:Receive"
            ],
            "Resource": "arn:aws:iot:us-west-2:1234567890xxx:topic/topic1" 
        }
     ]
}

I have tried almost every possible custom option but the policy works only for "*" wild card that means "any resource and/or any topics".

Answer 1

The reason is Subscribe needs topicfilter Resource and not topic

Here's an Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish",
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:xxx:topic/$aws/certificates/create/*",
        "arn:aws:iot:us-east-1:xxx:topic/$aws/provisioning-templates/test/provision/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Subscribe"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:xxx:topicfilter/$aws/certificates/create/*",
        "arn:aws:iot:us-east-1:xxx:topicfilter/$aws/provisioning-templates/test/provision/*"
      ]
    }
  ]
}