如何限制AWS-IoT事物在AWS IoT-Core中发布/订阅某些主题？

Question

我正在动态创建一个AWS-IoT东西，它可以发布任何主题，并且可以监听AWS-IoT-core代理中的任何主题。

我使用的策略非常广泛，这个东西可以执行服务器中的所有操作：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    }
  ]
}

现在我想缩小这些选项的范围。我只想允许这个东西发布到主题TOPICS-TEST/#，并且只订阅主题TOPICS-TEST/#。尽管我们在代理中有许多不同的主题，但我希望这个东西只能访问以TOPICS-TEST/开头的主题。

为了做到这一点，我检查了this documentation，并创建了这个策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iot:Connect"
            ],
            "Resource": [
                "arn:aws:iot:us-east-1:xxxx:client/${iot:Connection.Thing.ThingName}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iot:Subscribe"
            ],
            "Resource": [
                "arn:aws:iot:us-east-1:xxxx:topicfilter/TOPICS-TEST/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iot:Receive"
            ],
            "Resource": [
                "arn:aws:iot:us-east-1:xxxx:topicfilter/TOPICS-TEST/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iot:Publish"
            ],
            "Resource": [
                "arn:aws:iot:us-east-1:xxxx:topicfilter/TOPICS-TEST/*"
            ]
    }
    ]
}

以前的策略不起作用。我什么都看不到，我什么都不能发表。我遗漏了什么？

Answer 1

我知道该怎么做了

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Subscribe"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:xxxxxxxx:topicfilter/TOPICS-TEST*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Receive"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:xxxxxxxx:topic/TOPICS-TEST/*"
      ]
    }
  ]
}

之前的策略将允许thing接收来自AWS-IoT核心的通知，连接，仅推送到子主题TOPICS-TEST/ ...和订阅TOPICS-TEST/...。此翼将无法在此代理中查看其他主题。

我正在使用...:topicfilter/...进行发布。应为...:topic/...。