Mosquitto does not connect to AWS

Question

I'm new to AWS services, I'm still studying the docs. I received a quite long (working) Python code that exchange data with the Cloud.

Now I want to pub/sub messages with mosquitto. Basically I'm trying the following:

mosquitto_sub -h <id>.iot.us-east-2.amazonaws.com -p 443 -t "$aws/things/<sn>/shadow/update/delta" --cafile ./root-CA.crt --cert ./<sn>.cert.pem --key ./<sn>.private.key -d -i <sn> 

Where:

• <id> is the prefix of the host
• <sn> is the serial-number of the board

That command leads to:

Client sending CONNECT

and nothing else. I found a policy document inside a Python script (to be used when creating the device):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:<id>:client/<sn>"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:<id>:topic/$aws/things/<sn>/shadow/update",
        "arn:aws:iot:us-east-2:<id>:topic/IoTData"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Subscribe",
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:<id>:topicfilter/$aws/things/<sn>/shadow/update/accepted",
        "arn:aws:iot:us-east-2:<id>:topicfilter/$aws/things/<sn>/shadow/update/rejected",
        "arn:aws:iot:us-east-2:<id>:topicfilter/$aws/things/<sn>/shadow/update/delta"
      ]
    }
  ]
}

But I'm not sure if this is "attached" to the certificates, and even reading the docs I'm not sure if the CLI command is referred to my target's console (an RPi).

UPDATE

From the AWS console I create a new certificate and downloaded the three files to the target: <xxx>-certificate.pem.crt, <xxx>-private.pem.key, <xxx>-public.pem.key. Then I attached the policy to this certificated (from the AWS console itself).

Still the connection is not completed and no answer is received.

Answer 1

I had to attach the policy to the certificate and set the port to 8883 because the protocol is MQTT and not MQTT over Websockets.