1

I'm new to AWS services, I'm still studying the docs. I received a quite long (working) Python code that exchange data with the Cloud.

Now I want to pub/sub messages with mosquitto. Basically I'm trying the following:

mosquitto_sub -h <id>.iot.us-east-2.amazonaws.com -p 443 -t "$aws/things/<sn>/shadow/update/delta" --cafile ./root-CA.crt --cert ./<sn>.cert.pem --key ./<sn>.private.key -d -i <sn> 

Where:

  • <id> is the prefix of the host
  • <sn> is the serial-number of the board

That command leads to:

Client sending CONNECT

and nothing else. I found a policy document inside a Python script (to be used when creating the device):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:<id>:client/<sn>"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:<id>:topic/$aws/things/<sn>/shadow/update",
        "arn:aws:iot:us-east-2:<id>:topic/IoTData"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Subscribe",
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:<id>:topicfilter/$aws/things/<sn>/shadow/update/accepted",
        "arn:aws:iot:us-east-2:<id>:topicfilter/$aws/things/<sn>/shadow/update/rejected",
        "arn:aws:iot:us-east-2:<id>:topicfilter/$aws/things/<sn>/shadow/update/delta"
      ]
    }
  ]
}

But I'm not sure if this is "attached" to the certificates, and even reading the docs I'm not sure if the CLI command is referred to my target's console (an RPi).

UPDATE

From the AWS console I create a new certificate and downloaded the three files to the target: <xxx>-certificate.pem.crt, <xxx>-private.pem.key, <xxx>-public.pem.key. Then I attached the policy to this certificated (from the AWS console itself).

Still the connection is not completed and no answer is received.

  • Swap the " for ' round the topic, with double quotes the shell will try to expand$aws as an environment variable (which probably doesn't exist) – hardillb Sep 26 at 13:51
  • @hardillb, done. Unfortunately nothing has changed – Mark Sep 26 at 13:57
1

I had to attach the policy to the certificate and set the port to 8883 because the protocol is MQTT and not MQTT over Websockets.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.