影子和工作的 AWS IoT 政策

Question

我正在嘗試創建一個策略，允許我的東西讀取和更新影子，接受和運行作業，通常 function 允許在它們的命名空間中。 我已經經歷了無數次這樣的迭代，如果我將策略鎖定為“*”以外的任何內容，我將無法再在控制台中手動更新影子，也無法讓我的設備接受 MQTT 上的更改。 我的政策如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "arn:aws:iot:us-east-1:ACCOUNT:client/${iot:Connection.Thing.ThingName}"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": [
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/events/job/*",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/events/jobExecution/*",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/*",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": [
        "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/*",
        "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/events/jobExecution/*",
        "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/shadow/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": [
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:DescribeJobExecution",
        "iot:GetPendingJobExecutions",
        "iot:StartNextPendingJobExecution",
        "iot:UpdateJobExecution"
      ],
      "Resource": "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}"
    }
  ]
}

我意識到這里有些冗余，但我還是沒有成功。 我也嘗試過${iot:Connection.Thing.ThingName}硬編碼為事物名稱，但也沒有成功。 任何幫助將不勝感激，謝謝。

Answer 1

這對我有用。 確保沒有附加到您的證書的其他策略會覆蓋某些權限。

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "arn:aws:iot:us-east-1:ACCOUNT:client/${iot:Connection.Thing.ThingName}"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": [
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/update",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/delete",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/get",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/events/job/*",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/events/jobExecution/*",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": [
          "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/shadow/update/accepted",
          "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/shadow/update/rejected",
          "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/shadow/update/delta",
          "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/shadow/delete/accepted",
          "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/shadow/delete/rejected",
          "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/events/jobExecution/*",
          "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": [
          "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/update/accepted",
          "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/update/rejected",
          "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/update/delta",
          "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/delete/accepted",
          "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/delete/rejected",
          "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:DescribeJobExecution",
        "iot:GetPendingJobExecutions",
        "iot:StartNextPendingJobExecution",
        "iot:UpdateJobExecution"
      ],
      "Resource": "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}"
    }
  ]
}