X.509 证书策略变量 Amazon IoT Core

对于在注册 Amazon IoT Core 表中注册为事物的设备，以下策略允许在注册 Amazon IoT Core 表中注册了事物名称的客户端进行连接。该政策将发布特定于事物名称的主题的权限仅限于那些拥有Certificate.Subject.Organization属性设置为或的证书的客户端。"Example Corp" "AnyCompany"此限制是通过使用指定条件的"Condition"字段来实现的，必须满足该条件才能允许执行前面的操作。在此情况下，条件是与证书关联的 Certificate.Subject.Organization 属性必须包括列出的值之一：

{
    "Version":"2012-10-17",
    "Statement":[
      {
        "Effect":"Allow",
        "Action":[
          "iot:Connect"
        ],
        "Resource":[
          "arn:aws:iot:us-east-1:123456789012:client/${iot:Connection.Thing.ThingName}"
        ]
      },
      {
        "Effect":"Allow",
        "Action":[
          "iot:Publish"
        ],
        "Resource":[
          "arn:aws:iot:us-east-1:123456789012:topic/my/topic/${iot:Connection.Thing.ThingName}"
        ],
        "Condition":{
          "ForAllValues:StringEquals":{
            "iot:Certificate.Subject.Organization.List":[
              "Example Corp",
              "AnyCompany"
            ]
          }
        }
      }
    ]
}

对于未在注册 Amazon IoT Core 表中注册为事物的设备，以下策略授予 Amazon IoT Core 使用客户端 ID client1 client2、和进行连接的权限client3。该政策将向特定于客户端 ID 的主题发布的权限仅限于那些拥有Certificate.Subject.Organization属性设置为"Example Corp"或的证书的客户端。"AnyCompany"通过使用 "Condition" 字段来完成此限制，该字段指定要允许前面的操作而必须满足的条件。在此情况下，条件是与证书关联的 Certificate.Subject.Organization 属性必须包括列出的值之一：

{
    "Version":"2012-10-17",
    "Statement":[
      {
        "Effect":"Allow",
        "Action":[
          "iot:Connect"
        ],
        "Resource":[
          "arn:aws:iot:us-east-1:123456789012:client/client1",
          "arn:aws:iot:us-east-1:123456789012:client/client2",
          "arn:aws:iot:us-east-1:123456789012:client/client3"
        ]
      },
      {
        "Effect":"Allow",
        "Action":[
          "iot:Publish"
        ],
        "Resource":[
          "arn:aws:iot:us-east-1:123456789012:topic/my/topic/${iot:ClientId}"
        ],
        "Condition":{
          "ForAllValues:StringEquals":{
            "iot:Certificate.Subject.Organization.List":[
              "Example Corp",
              "AnyCompany"
            ]
          }
        }
      }
    ]
}