Skip to content
IoT Service

Custom policy

AWS custom policy

An AWS device has permissions to publish and subscribe to any topic prefixed with its groupId by default. i.e {groupId}/* where,

  • {groupId} is the unique identifier of a group
  • can be any number of strings separated by slashes

For example, {groupId}/gps, **{groupId}/commands**, **{groupId}/device/location** etc.

To change the default behavior of a device, you can create a custom policy.

A custom policy comprises publish and subscribe topics prefixed with groupId. It can be attached to a device to restrict the access to the topics a device can publish and subscribe to.

For example, if a device has to publish only to the topic {groupId}/gps and subscribe only to the topic {groupId}/ping/location, then custom policy should be defined as below.

"topics": {
    "publish": [
      "995d37c7-0f07-4414-8760-79388927c222/gps"
    ],
    "subscribe": [
      "995d37c7-0f07-4414-8760-79388927c222/ping/location"
    ]
  }

!!!Note

* Custom policy supports characters in the topic definition. Supported characters are:
    * Publish Topics : \* and ?
    * Subscribe Topics : \*, ?, + and # (# should be present only at the end of the topic)
* \* and ? are wildcard characters. In a policy, the \* represents any combination of characters and a question mark ? represents any single character. In policy, the MQTT wildcard characters, + and # are treated as those characters with no special meaning. To describe multiple topic suffixes, use the \* and ? wildcard characters in place of the MQTT wildcard characters.