How do you set your policy to allow a device to subscribe to jobs?

Question

I got my policy working for my primary app logic. It can now connect, subscribe and receive ONLY via its unique, verified ThingName. It is not allowed to publish anything.  
  
But I'd also like to run the jobs-agent.js script from the sdk examples so I can reboot and perform other tasks. These used to work for me, but don't anymore and I have verified that it's because the jobs-agent can't subscribe to the appropriate topics. (It works again when I change the policy to "*".)  
  
Reading the jobs-agent.js file, I see jobs are in the form "$aws/things/{thingName}/jobs/#" but nothing in the policy documentation shows how to handle this form.   
  
**How do you write a policy to allow for a device to subscribe to topics of the form $aws/things/{thingName}/jobs/#?**

Answer

Nailed it. This policy grants access to my application logic (ThingName/**) and the jobs in the form that aws-iot-device-sdk-js/examples/jobs-agent.js wants them ($aws/things/ThingName/jobs/**).

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:MYACCOUNTID:client/${iot:Connection.Thing.ThingName}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Subscribe"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:MYACCOUNTID:topicfilter/${iot:Connection.Thing.ThingName}/*",
        "arn:aws:iot:us-east-1:MYACCOUNTID:topicfilter/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:MYACCOUNTID:topic/${iot:Connection.Thing.ThingName}/*",
        "arn:aws:iot:us-east-1:MYACCOUNTID:topic/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish"
      ],
      "Resource": [
        "arn:aws:iot:us-east-1:MYACCOUNTID:topic/$aws/things/${iot:Connection.Thing.ThingName}/jobs/*"
      ]
    }
  ]
}
```

How do you set your policy to allow a device to subscribe to jobs?

Relevant content