Tutorial: Provisioning your device in Amazon IoT

To create an Amazon IoT policy

1. On the left menu, choose Secure, and then choose Policies. If your account has existing policies, choose Create, otherwise, on the You don’t have a policy yet page, choose Create a policy.

2. On the Create a policy page:

   1. Enter a name for the policy in the Name field (for example, My_Device_Shadow_policy). Do not use personally identifiable information in your policy names.

   2. In the policy document, you describe connect, subscribe, receive, and publish actions that give the device permission to publish and subscribe to the MQTT reserved topics.

      Copy the following sample policy and paste it in your policy document. Replace thingname with the name of the thing that you'll create (for example, My_light_bulb), region with the Amazon IoT Region where you're using the services, and account with your Amazon Web Services account number. For more information about Amazon IoT policies, see Amazon IoT Core policies.

      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "iot:Publish"
            ],
            "Resource": [
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/get",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/update"
            ]
          },
          {
            "Effect": "Allow",
            "Action": [
              "iot:Receive"
            ],
            "Resource": [
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/get/accepted",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/get/rejected",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/update/accepted",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/update/rejected",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/update/delta"
            ]
          },
          {
            "Effect": "Allow",
            "Action": [
              "iot:Subscribe"
            ],
            "Resource": [
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/get/accepted",
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/get/rejected",
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/update/accepted",
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/update/rejected",
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/update/delta"
            ]
          },
          {
            "Effect": "Allow",
            "Action": "iot:Connect",
            "Resource": "arn:aws:iot:region:account:client/test-*"
          }
        ]
      }