Creating IAM policies and roles for a user installing a device

Open the Policies hub in the IAM console.

Choose Create Policy.

On the Create policy page, choose the JSON tab.

Switch to the page in the Amazon IoT console where you chose Configure user policy and role.

In the Sample provisioning policy, choose Copy.

Switch back to the IAM console.

In the JSON editor, paste the policy you copied from the Amazon IoT console. This policy is specific to the template you're creating in the Amazon IoT console.

To continue, choose Next: Tags.

On the Add tags (Optional) page, choose Add tag for each tag you want to add to this policy. You can skip this step if you don't have any tags to add.

To continue, choose Next: Review.

On the Review policy page, do the following:

1. For Name*, enter a name for the policy that will help you remember the policy's purpose.

   Note the name you give this policy because you'll use it in the next procedure.

2. You can choose to enter an optional description for the policy you're creating.

3. Review the rest of this policy and its tags.

To finish creating the new policy, choose Create policy.

Open the Role hub in the IAM console.

Choose Create role.

In Select trusted entity, choose the type of trusted entity that you want to give access to the template you're creating.

Choose or enter the identification of the trusted entity that you want to grant access to, and then choose Next.

On the Add permissions page, in Permission policies, in the search box, enter the name of the policy you created in the previous procedure.

For the policy list, choose the policy that you created in the previous procedure, and then choose Next.

In the Name, review, and create section, do the following:

1. For Role name, enter a role name that will help you remember the role's purpose.

2. For Description, you can choose to enter an optional description of the Role. This isn't required to continue.

3. Review the values in Step 1 and Step 2.

4. For Add tags (Optional), you can choose to add tags to this role. This isn't required to continue.

5. Verify the information on this page is complete and correct, and then choose Create role.

Open the Policies hub in the IAM console.

In the search box, enter the name of the policy to update.

For the list below the search box, find the policy you want to update and choose the policy name.

For Policy summary, choose the JSON tab, if that panel isn't already visible.

To modify the policy document, choose Edit policy.

In the editor, choose the JSON tab, if that panel isn't already visible.

In the policy document, find the policy statement that contains the iot:CreateProvisioningClaim action.

If the policy document doesn't contain a policy statement with the iot:CreateProvisioningClaim action, copy the following statement snippet and paste it as an additional entry in the Statement array in the policy document.

{
    "Effect": "Allow",
    "Action": [
        "iot:CreateProvisioningClaim"
    ],
    "Resource": [
        "--PUT YOUR NEW TEMPLATE ARN HERE--"
    ]
}

Switch to the page in the Amazon IoT console where you chose Modify user role permissions.

Find the Resource ARN of the template and choose Copy.

Switch back to the IAM console.

Paste the copied Amazon Resource Name (ARN) at the top of the list of template ARNs in the Statement array so that it's the first entry.

If this is the only ARN in the array, remove the comma at end of the value you just pasted.

Review the updated policy statement and correct any errors indicated by the editor.

To save the updated policy document, choose Review policy.

Review the policy and then choose Save changes.

Return to the Amazon IoT console.