无法使用工作证书使用 aws-iot-device-sdk-v2 for JavaScript 进行连接

Question

使用JavaScript SDK的旧版本可以正常连接，但是v2在运行pub_sub示例时产生以下错误:

events.js:353
throw er; // Unhandled 'error' event
^
CrtError: Failed to connect: libaws-c-mqtt: AWS_ERROR_MQTT_UNEXPECTED_HANGUP, The connection was closed unexpectedly.
at /Users/calebbrewer/dev/node-sandbox/node_modules/aws-iot-device-sdk-v2/node_modules/aws-crt/dist/native/mqtt.js:333:36
at processTicksAndRejections (internal/process/task_queues.js:77:11)
Emitted 'error' event on MqttClientConnection instance at:
at MqttClientConnection.emit (/Users/calebbrewer/dev/node-sandbox/node_modules/aws-iot-device-sdk-v2/node_modules/aws-crt/dist/common/event.js:75:22)
at /Users/calebbrewer/dev/node-sandbox/node_modules/aws-iot-device-sdk-v2/node_modules/aws-crt/dist/native/mqtt.js:333:22
at processTicksAndRejections (internal/process/task_queues.js:77:11) {
error: 'Failed to connect: libaws-c-mqtt: AWS_ERROR_MQTT_UNEXPECTED_HANGUP, The connection was closed unexpectedly.',
error_code: undefined,
error_name: undefined
}

我通过控制台手动配置证书，使用"Create things"工作流。

任何关于如何进一步调试这个问题的想法将是感激的-我已经碰壁了!

编辑我在CloudWatch日志中发现了以下错误，其中一些值被截断:

{
"timestamp": "2021-09-02 16:27:13.163",
"logLevel": "INFO",
"traceId": "93d42145-31af-ed6c-7f16-80031602970c",
"accountId": "$AWS_ACCOUNT_ID",
"status": "Success",
"eventType": "Subscribe",
"protocol": "MQTT",
"topicName": "topic_1",
"clientId": "caleb-test",
"principalId": "f....2",
"sourceIp": "7...2",
"sourcePort": 40494
}

复制我的策略，因为这是击中云的事实，我想知道这是否会导致问题:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iot:Publish",
"iot:Receive",
"iot:RetainPublish"
],
"Resource": [
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topic/sdk/test/java",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topic/sdk/test/Python",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topic/topic_1",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topic/topic_2"
]
},
{
"Effect": "Allow",
"Action": [
"iot:Subscribe"
],
"Resource": [
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topicfilter/sdk/test/java",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topicfilter/sdk/test/Python",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topicfilter/topic_1",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topicfilter/topic_2"
]
},
{
"Effect": "Allow",
"Action": [
"iot:Connect"
],
"Resource": [
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:client/sdk-java",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:client/basicPubSub",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:client/sdk-nodejs-*"
]
}
]
}

Answer 1

看起来应该归咎于策略的iot:Connect语句中定义的资源:唯一需要的资源是实际的客户机本身。下面的策略已经为我解决了这个问题:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iot:Publish",
"iot:Receive",
"iot:RetainPublish"
],
"Resource": [
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topic/sdk/test/java",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topic/sdk/test/Python",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topic/topic_1",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topic/topic_2"
]
},
{
"Effect": "Allow",
"Action": [
"iot:Subscribe"
],
"Resource": [
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topicfilter/sdk/test/java",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topicfilter/sdk/test/Python",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topicfilter/topic_1",
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:topicfilter/topic_2"
]
},
{
"Effect": "Allow",
"Action": [
"iot:Connect"
],
"Resource": [
"arn:aws:iot:us-west-2:$AWS_ACCOUNT_ID:client/caleb-test"
]
}
]
}