教程：在 Amazon IoT中预置设备

创建 Amazon IoT策略

1. 在左侧菜单中，选择 Secure（安全），然后选 Policies（策略）。如果您的账户已有策略，请选择 Create（创建），否则，在 You don’t have a policy yet（您还没有策略）页面上，选择 Create a policy（创建策略）。

2. 在 Create a policy（创建策略）页面上：

   1. 在 Name（名称）字段，输入策略的名称（例如 My_Device_Shadow_policy）。请勿在策略名称中使用个人身份信息。

   2. 在策略文档中，您描述了授予设备发布和订阅 MQTT 保留主题权限的连接、订阅、接收和发布操作。

      复制以下策略并将其粘贴到策略文档中。将 thingname替换为您要创建的事物名称（例如 My_light_bulb)，将 region替换为您正在使用这些服务的 Amazon IoT区域，将 account替换为您的 Amazon Web Services 账户数量。有关 Amazon IoT策略的更多信息，请参阅 Amazon IoT Core 政策。

      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "iot:Publish"
            ],
            "Resource": [
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/get",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/update"
            ]
          },
          {
            "Effect": "Allow",
            "Action": [
              "iot:Receive"
            ],
            "Resource": [
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/get/accepted",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/get/rejected",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/update/accepted",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/update/rejected",
              "arn:aws:iot:region:account:topic/$aws/things/thingname/shadow/update/delta"
            ]
          },
          {
            "Effect": "Allow",
            "Action": [
              "iot:Subscribe"
            ],
            "Resource": [
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/get/accepted",
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/get/rejected",
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/update/accepted",
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/update/rejected",
              "arn:aws:iot:region:account:topicfilter/$aws/things/thingname/shadow/update/delta"
            ]
          },
          {
            "Effect": "Allow",
            "Action": "iot:Connect",
            "Resource": "arn:aws:iot:region:account:client/test-*"
          }
        ]
      }