Question

我正在使用AWSIoTPythonSDK将消息从温度传感器发布到AWS IoT Core。当我在证书策略中将主题明确指定为“资源”时，我在Cloudwatch中收到AUTHORIZATION_ERROR

注意：为安全起见，更改了PrincipledID（证书名称）

2020-02-22T20:03:48.371-07:00
2020-02-23 03:03:48.371 TRACEID:2a0de6c8-dd28-586e-671f-119de983b5d5 PRINCIPALID:9ec115f5665XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0d7d6b7 /ERROR/ EVENT:PublishEvent TOPICNAME:topic/tSensor01/tempmon MESSAGE:PublishIn Status: AUTHORIZATION_ERROR Failure reason:AUTHORIZATION_FAILURE
@ingestionTime
1582427034767
@log
549210374177:AWSIotLogs
@logStream
a2d5c94d-f908-4e76-bd9e-3627976e8b72_549210374177_0
@message
2020-02-23 03:03:48.371 TRACEID:2a0de6c8-dd28-586e-671f-119de983b5d5 PRINCIPALID:9ec115f5665XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0d7d6b7 /ERROR/ EVENT:PublishEvent TOPICNAME:topic/tSensor01/tempmon MESSAGE:PublishIn Status: AUTHORIZATION_ERROR Failure reason:AUTHORIZATION_FAILURE

这是导致AUTHORIZATION_ERROR的我的证书策略（仅显示iot：Publish）

"Statement": [
{
"Effect": "Allow",
"Action": [
"iot:Publish",
"iot:Receive"
],
"Resource": [
"arn:aws:iot:<region>:<account id>:topic/${iot:Connection.Thing.ThingName}/*",
"arn:aws:iot:<region>:<account id>:topic/${iot:ClientId}/*",
"arn:aws:iot:<region>:<account id>:topic/tSensor01/*",
"arn:aws:iot:<region>:<account id>:topic/tSensor01/tempmon"
]
},

但是，通过在策略中添加以下行arn：aws：iot ::: *来隔离问题，我使用了蛮力方法（这是不可接受的），并且来自设备的消息也已发布。

{
"Effect": "Allow",
"Action": [
"iot:Publish",
"iot:Receive"
],
"Resource": [
"arn:aws:iot:<region>:<account id>:topic/${iot:Connection.Thing.ThingName}/*",
"arn:aws:iot:<region>:<account id>:topic/${iot:ClientId}/*",
"arn:aws:iot:<region>:<account id>:topic/tSensor01/*",
"arn:aws:iot:<region>:<account id>:topic/tSensor01/tempmon",
"arn:aws:iot:<region>:<account id>:*"
]
},

这种蛮力方法不可行，我想知道根本原因。

设备连接正常。因此可以安全地认为我的凭据信息不是问题

以下在Cloudwatch日志中显示连接跟踪

2020-02-22T20:03:48.314-07:00
2020-02-23 03:03:48.314 TRACEID:f801f2bb-147f-5c94-2e2e-7d63d7cacd26 PRINCIPALID:9ec115f5665XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0d7d6b7 /INFO/ EVENT:MQTT Client Connect MESSAGE:Connect Status: SUCCESS
@ingestionTime
1582427034767
@log
549210374177:AWSIotLogs
@logStream
a2d5c94d-f908-4e76-bd9e-3627976e8b72_549210374177_0
@message
2020-02-23 03:03:48.314 TRACEID:f801f2bb-147f-5c94-2e2e-7d63d7cacd26 PRINCIPALID:9ec115f5665XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0d7d6b7 /INFO/ EVENT:MQTT Client Connect MESSAGE:Connect Status: SUCCESS

谢谢

Answer 1

我能够解决此问题。证书策略没有问题。问题是我传递给AWS Device SDK的参数。我将 topic / tSensor01 / tempmon 传递给SDK，当我将 tSensor01 / tempmon 传递给SDK时，它解决了该问题。 topic 可以被认为是一项服务，不应传递给SDK

AWS IoT：策略中的资源导致AWS IoT PublishIn状态：AUTHORIZATION_ERROR

1 个答案: