How do I use an authenticated AWS Cognito identity to access an AWS IoT endpoint?

Question

I am using an MQTT client in JavaScript (paho-mqtt-js) to connect to an AWS IoT endpoint and I am able to connect if I use my own AWS credentials.

However, if I use credentials generated by Cognito for a logged in user I am unable to do so. My Cognito authorised role in IAM has a policy of "AWSIoTFullAccess" attached to it so I am confused as to why these credentials return a 403 error each time.

Any help with regard to this would be greatly appreciated.

I have a similar problem. With a IAM User with the proper policy I can connect, but with Cognito credentials I can't. The IAM role policy is correct, but unlike yourself, AWS does not respond with 403, but connection is never finished. If I change my Cognito role to a restricted policy, then I get a 403. So is not a credentials error https://forums.aws.amazon.com/thread.jspa?threadID=241543 — nachoab, Oct 27 '16 at 11:24

score 0 · Answer 1 · answered Jul 31 '17 at 08:03

Encountered similar problem when dealing with Federated identity. Some tips to resolve the problem:

Please use the cloudwatch logs to figure out the problems it was very handy.
Also look at the cloudwatch logs with topic name ending with _CognitoIdentityCredentials
Using the appropriate session tokens
Use AWS CLI and execute attach-principal-policy to try out manually.
Please refer to this link https://github.com/alfonsodev/aws-iot-example/blob/master/index.js to run locally with nodejs to troubleshoot the issue.
Please use attach principal policy. This link http://techqa.info/programming/question/40301345/connect-to-AWS-IoT-using-web-socket-with-Cognito-authenticated-users was very helpful for integration

Hope this helps!

score 0 · Answer 2 · answered Aug 19 '18 at 13:23

0

Check your AWS IoT policies. You'll also need an AWS IoT policy for your Cognito identity in addition to the policy you've attached to the IAM Role. See the docs here:

https://docs.aws.amazon.com/iot/latest/developerguide/authorization.html

answered Aug 19 '18 at 13:23

Excel r 8

105
6

How do I use an authenticated AWS Cognito identity to access an AWS IoT endpoint?

2 Answers2