Custom policy

AWS custom policy

An AWS device has permissions to publish and subscribe to any topic prefixed with its groupId by default. i.e {groupId}/* where,

• {groupId} is the unique identifier of a group
• can be any number of strings separated by slashes

For example, {groupId}/gps, **{groupId}/commands**, **{groupId}/device/location** etc.

To change the default behavior of a device, you can create a custom policy.

A custom policy comprises publish and subscribe topics prefixed with groupId. It can be attached to a device to restrict the access to the topics a device can publish and subscribe to.

For example, if a device has to publish only to the topic {groupId}/gps and subscribe only to the topic {groupId}/ping/location, then custom policy should be defined as below.

"topics": {
    "publish": [
      "995d37c7-0f07-4414-8760-79388927c222/gps"
    ],
    "subscribe": [
      "995d37c7-0f07-4414-8760-79388927c222/ping/location"
    ]
  }

Note

• Custom policy supports characters in the topic definition. Supported characters are:
  • Publish Topics : * and ?
  • Subscribe Topics : *, ?, + and # (# should be present only at the end of the topic)
• * and ? are wildcard characters. In a policy, the * represents any combination of characters and a question mark ? represents any single character. In policy, the MQTT wildcard characters, + and # are treated as those characters with no special meaning. To describe multiple topic suffixes, use the * and ? wildcard characters in place of the MQTT wildcard characters.