Angular AWS IoT核心：无法使用Mqtt连接Cognito标识

应用程序是由angular开发的

首先，用户应该使用Cognito登录。因此，在用户登录之后，应用程序将获得CognitoUser数据，如其id令牌、访问的密钥和会话令牌

然后应用程序将开始连接到Iot Core，并尝试订阅或发布数据到我想要的主题。但我总是遇到Mqtt立即断开连接的情况

以下是我的连接代码：

export class MqttService{
  private awsIot: any;
  private iotDevice: any;
  public sendMessageSubject = new Subject<any>();
  public receiveMessageSubject = new Subject<string>();

  constructor(private authService: AuthService, private router: Router) { 
    this.awsIot = require('aws-iot-device-sdk');
    AWS.config.region = 'us-east-2';

    this.authService.getUserPool.getCurrentUser().getSession(function(err, session) {
      if (err) {
        console.log(err);
        return;
      } else if(session.isValid()) {
        this.initMqtt(session.getIdToken().getJwtToken());
      }
    });
  }

  public sendMesssage(value: string): Observable<boolean> {
    const topic = 'topic/topic1';
    const res = this.iotDevice.publish(topic, JSON.stringify({'message': value}));

    this.sendMessageSubject.next(res);
  }

  private initMqtt(idToken: string) {
    AWS.config.credentials = new AWS.CognitoIdentityCredentials({
      IdentityPoolId: '<< IDENTITY-POOL-ID >>',
      Logins: {
          'cognito-idp.us-east-2.amazonaws.com/us-east-2_XXXXXXXXX': idToken
      }
    });

    (<AWS.CognitoIdentityCredentials> AWS.config.credentials).refresh((error) => {
      if (error) {
        console.log(error);
      } else {
        console.log('success');
        const deviceOptions = {
          clientId: '<< CLIENT-ID >>',
          host: 'XXXXXXXXXXXXXX-ats.iot.us-east-2.amazonaws.com',
          protocol: 'wss',
          port: 443,
          accessKeyId: AWS.config.credentials.accessKeyId,
          secretKey: AWS.config.credentials.secretAccessKey,
          sessionToken: AWS.config.credentials.sessionToken,
          reconnectPeriod: 0
        }

        this.iotDevice = this.awsIot.device(deviceOptions);

        this.iotDevice.on('error', (err) => {
          console.log('MQTT Error');
        });
  
        this.iotDevice.on('connect', (result) => {
          /* It is always triggered here, then go to 'close' scope */
          console.log('MQTT connected');
          this.iotDevice.subscribe('topic/topic1');
        });
  
        this.iotDevice.on('reconnect', () => {
          console.log('MQTT reconnect');
        });
  
        this.iotDevice.on('close', () => {
          /* It is always triggered immediately after trigger 'connect' */
          this.iotDevice.end();
          console.log('MQTT Disconnected');
        });
  
        this.iotDevice.on('message', (sourceTopic: string, payload: any) => {
          console.log('Message Received from topic:' + sourceTopic);
          console.log('Message content:' + payload.toString());
          this.receiveMessageSubject.next(payload.toString());
        });
      }
    });
  }
}

导出类MqttService{
私人awsIot：任何；
专用设备：任何；
public sendMessageSubject=新主题（）；
public receiveMessageSubject=新主题（）；
构造函数（专用authService:authService，专用路由器：路由器）{
this.awsIot=require（'aws-iot-device-sdk'）；
AWS.config.region='us-east-2'；
this.authService.getUserPool.getCurrentUser（）.getSession（函数（err，session）{
如果（错误）{
控制台日志（err）；
返回；
}else if（session.isValid（））{
this.initMqtt（session.getIdToken（）.getJwtToken（））；
}
});
}
公共SendMessage（值：字符串）：可观察{
const topic='topic/topic1'；
const res=this.iotDevice.publish（主题，JSON.stringify（{'message'：value}））；
this.sendMessageSubject.next（res）；
}
私有initMqtt（idToken:string）{
AWS.config.credentials=新的AWS.CognitoIdentityCredentials({
IdentityPoolId:“>”，
登录：{
“cognito idp.us-east-2.amazonaws.com/us-east-2_uxxxxxxxx”：idToken
}
});
（AWS.config.credentials）.刷新（（错误）=>{
如果（错误）{
console.log（错误）；
}否则{
console.log（'success'）；
常数设备选项={
clientId:“>”，
主机：“xxxxxxxxx-ats.iot.us-east-2.amazonaws.com”，
协议：“wss”，
港口：443，
accessKeyId:AWS.config.credentials.accessKeyId，
secretKey:AWS.config.credentials.secretAccessKey，
sessionToken:AWS.config.credentials.sessionToken，
重新连接周期：0
}
this.iotDevice=this.awsIot.device（设备选项）；
this.iotDevice.on（'error'，（err）=>{
log（'MQTT错误'）；
});
this.iotDevice.on（'connect'，（结果）=>{
/*它总是在这里触发，然后转到“关闭”范围*/
log（'MQTT-connected'）；
this.iotDevice.subscribe（'topic/topic1'）；
});
此.IoDevice.on（'reconnect'，（）=>{
log（'MQTT reconnect'）；
});
this.iotDevice.on（'close'，（）=>{
/*它总是在触发“连接”后立即触发*/
此.iotDevice.end（）；
log（'MQTT Disconnected'）；
});
this.iotDevice.on（'message'，（sourceTopic:string，payload:any）=>{
log（'从主题接收的消息：'+sourceTopic）；
log（'messagecontent:'+payload.toString（））；
this.receiveMessageSubject.next（payload.toString（））；
});
}
});
}
}

在运行代码之前，我还运行以下命令：

aws物联网附加主体策略--策略名称“>”--主体“>”

我还将物联网策略附加到身份验证角色

我认为主要问题出在

“cognito-idp.us-east-2.amazonaws.com/us-east-2_uuxxxxxxxx”：idToken

，但我不确定

---

如果有人知道，请告诉我。谢谢

我在Iot Core中修改了策略，现在可以正常工作了

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    }
  ]
}

原件：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "arn:aws:iot:us-east-2:xxxxxxxxxxxx:client/<< CLIENT-ID >>"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:us-east-2:xxxxxxxxxxxx:topic/topoc1/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "arn:aws:iot:us-east-2:xxxxxxxxxxxx:topic/topic1/*"
    }
  ]
}

{
“版本”：“2012-10-17”，
“声明”：[
{
“效果”：“允许”，
“行动”：“物联网：连接”，
“资源”：“arn:aws:iot:us-east-2:XXXXXXXXXX:client/>”
},
{
“效果”：“允许”，
“行动”：“物联网：发布”，
“资源”：“arn:aws:iot:us-east-2:XXXXXXXXXX:topic/topoc1/*”
},
{
“效果”：“允许”，
“操作”：“物联网：订阅”，
“资源”：“arn:aws:iot:us-east-2:XXXXXXXXXX:topic/topic1/*”
}
]
}

请注意，与AWS的最低特权原则相比，您新定义的策略过于宽松