Connection and publishing operations using paho-mqtt not working on AWS IoT

Question

Attempted to work with AWS IoT, the following code was working earlier:

import paho.mqtt.client as mqtt
import ssl, random
from time import sleep

mqtt_url = "XXXXXXXX.iot.us-east-2.amazonaws.com"
root_ca = './certs/iotRootCA.pem'
public_crt = './certs/deviceCert.crt'
private_key = './certs/deviceCert.key'

connflag = False

def on_connect(client, userdata, flags, response_code):
    global connflag
    connflag = True
    print("Connected with status: {0}".format(response_code))

def on_publish(client, userdata, mid):
    print userdata + " -- " + mid
    #client.disconnect()

if __name__ == "__main__":
    print "Loaded MQTT configuration information."
    print "Endpoint URL: " + mqtt_url
    print "Root Cert: " + root_ca
    print "Device Cert: " + public_crt
    print "Private Key: " + private_key

    client = mqtt.Client()
    client.tls_set(root_ca,
                   certfile = public_crt,
                   keyfile = private_key,
                   cert_reqs = ssl.CERT_REQUIRED,
                   tls_version = ssl.PROTOCOL_TLSv1_2,
                   ciphers = None)

    client.on_connect = on_connect
#    client.on_publish = on_publish

    print "Connecting to AWS IoT Broker..."
    client.connect(mqtt_url, port = 8883, keepalive=60)
    client.loop_start()
#    client.loop_forever()

    while 1==1:
        sleep(0.5)
        print connflag
        if connflag == True:
            print "Publishing..."
            ap_measurement = random.uniform(25.0, 150.0)
            client.publish("ActivePower", ap_measurement, qos=1)
            print("ActivePower published: " + "%.2f" % ap_measurement )
        else:
            print "waiting for connection..."

Later, I received the following error(there is no connection):

python awsiot-publish.py
Loaded MQTT configuration information.
Endpoint URL: XXXXXXX.iot.us-east-2.amazonaws.com
Root Cert: ./certs/iotRootCA.pem
Device Cert: ./certs/deviceCert.crt
Private Key: ./certs/deviceCert.key
Connecting to AWS IoT Broker... False
waiting for connection...
False
waiting for connection...
False
waiting for connection... False

What should i do about this?

Answer 1

I'd say your issue is mainly that your certificate's policy lacks permissions to connect. If it's unspecified, paho generates a random client_id. You should set the client_id. You also need a policy allowing your certificate to connect using that client id.

{
  "Effect": "Allow",
  "Action": "iot:Connect",
  "Resource":"arn:aws:iot:us-east1:123456789012:client/yourClientIdGoesHere"
}

You can also set the resource in your policy to * and then connect with any client_id:

{
  "Effect": "Allow",
  "Action": "iot:Connect",
  "Resource":"*"
}