Register aws iot device using cognito credentials

Question

I am working on a app where I need to track the changes of some devices and show those in the frontend.

For the user login I'm using cognito and I'm getting the credential after login and I already got valid credential because I connected AWS DynamoDB using the same credential.

Now I want to register a aws.iot device with the same cognito credential.

I'm following https://github.com/aws/aws-iot-device-sdk-js

I checked with some static credential with a aws user like:

client.device = awsIot.device({
    clientId: clientID,
    host: host,
    accessKeyId: AccessKeyId,
    secretKey: secretKey,
    protocol: 'wss'
});

And this works fine.

Then I tried the same using aws cognito assessKeyId and secretKey, but this I time I got 403.

I checked connect to AWS IoT using web socket with Cognito authenticated users, but it didn't help.

My current code is like:

    var awsIot = require('aws-iot-device-sdk');

    AWS.config.credentials.get(() => {
        const IoT = new AWS.Iot();
        IoT.attachPrincipalPolicy({
            policyName: 'PubSub',
            principal: AWS.config.credentials.identityId
        }, (err, res) => {
            if (err) {
            } else {
                let credential;
                if (AWS.config.credentials && AWS.config.credentials.data && AWS.config.credentials.data.Credentials) {
                    let credentials = AWS.config.credentials.data.Credentials;
                    awsIot.device({
                       clientId: clientID,
                       host: host,
                       accessKeyId: credentials.AccessKeyId,
                       secretKey: credentials.secretKey,
                       protocol: 'wss',
                       sessionToken: credentials.SessionToken
                    });
                }
            }
        });
    });

Can anybody please help me, what I'm missing here.

score 2 · Answer 1 · answered Nov 26 '17 at 04:38

What worked for me was passing in the data from the AWS.config.credentials object directly, i.e.

if (AWS.config.credentials) {
  awsIot.device({
     clientId: clientID,
     host: host,
     accessKeyId: AWS.config.credentials.accessKeyId,
     secretKey: AWS.config.credentials.secretAccessKey,
     protocol: 'wss',
     sessionToken: AWS.config.credentials.sessionToken
  });
}

Perhaps check also that the accessKeyId etc. begin with small letters and not caps, if you are calling via this method.

Sorry, this doesn't work as well, yeah I was getting the accesskey started with capital letter, I used to lower case well but still got the same error. — Indranil Mondal, Nov 26 '17 at 14:33

score 0 · Accepted Answer · answered Nov 26 '17 at 14:42

Finally I got the solution in this case, all I needed to do, is pass empty string as accesskey, secret key and session token while creating the device and then device credential as the device is created.

    AWS.config.credentials.get(() => {
        const IoT = new AWS.Iot();
        IoT.attachPrincipalPolicy({
            policyName: 'PubSub',
            principal: AWS.config.credentials.identityId
        }, (err, res) => {
            if (err) {
            } else {
                let credential;
                if (AWS.config.credentials && AWS.config.credentials.data && AWS.config.credentials.data.Credentials) {
                    let credentials = AWS.config.credentials.data.Credentials;
                    var device = awsIot.device({
                       clientId: clientID,
                       host: host,
                       accessKeyId: '',
                       secretKey: '',
                       protocol: 'wss',
                       sessionToken: ''
                    });
                    device.updateWebSocketCredentials(credentials.AccessKeyId, credentials.SecretKey, credentials.SessionToken, credentials.Expiration);
                }
            }
        });
    });

Hey Indra, so for every cognito user, you have a aws-iot thing registered? ie; there are things that you're talking to which are some devices, also the user who will be connecting via the app need to be things (register a new thing for every new user who will be connecting to aws-iot via the app?) in aws-iot? — user2967920, Jan 25 '19 at 04:41

Register aws iot device using cognito credentials

2 Answers2