AWS IoT影子与作业权限策略配置问题求助

核心问题 #

你的策略存在两个关键缺陷：

1. 控制台更新Shadow依赖API权限而非MQTT权限：控制台操作Thing Shadow是通过AWS IoT Core的REST API完成的，不是MQTT消息，原策略只配置了MQTT的Publish/Subscribe权限，缺少对应的API操作权限。
2. Job相关资源与权限不匹配：Job操作的资源目标不是MQTT Topic，而是Thing本身的ARN，且部分MQTT Topic权限覆盖不全。

修正后的AWS IoT策略 #

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "arn:aws:iot:us-east-1:ACCOUNT:client/${iot:Connection.Thing.ThingName}"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish",
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/shadow/#",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/things/${iot:Connection.Thing.ThingName}/jobs/#",
        "arn:aws:iot:us-east-1:ACCOUNT:topic/$aws/events/jobExecution/${iot:Connection.Thing.ThingName}/#"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": [
        "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/shadow/#",
        "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/jobs/#",
        "arn:aws:iot:us-east-1:ACCOUNT:topicfilter/$aws/events/jobExecution/${iot:Connection.Thing.ThingName}/#"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:GetThingShadow",
        "iot:UpdateThingShadow",
        "iot:DeleteThingShadow"
      ],
      "Resource": "arn:aws:iot:us-east-1:ACCOUNT:thing/${iot:Connection.Thing.ThingName}"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:DescribeJobExecution",
        "iot:GetPendingJobExecutions",
        "iot:StartNextPendingJobExecution",
        "iot:UpdateJobExecution"
      ],
      "Resource": "arn:aws:iot:us-east-1:ACCOUNT:thing/${iot:Connection.Thing.ThingName}"
    }
  ]
}

关键调整说明 #

• 补充Shadow API权限：新增iot:GetThingShadow、iot:UpdateThingShadow、iot:DeleteThingShadow，资源指向Thing的ARN，解决控制台无法手动更新Shadow的问题。
• 规范Job资源目标：Job操作的资源改为Thing的ARN（而非Topic），符合AWS IoT权限模型要求。
• 精简MQTT权限：用#通配符替代多层*，更精准覆盖Thing自身命名空间下的所有Shadow/Job相关Topic，同时避免冗余。
• 修正Subscribe资源类型：所有订阅权限的资源统一使用topicfilter类型，原策略中错误地将部分资源写为topic，导致订阅权限不生效。

内容的提问来源于stack exchange，提问作者Bill