How to make aws-iot to reject shadow change requested by a device

Hello, there is currently no way to help you implement this feature.

Shadow topics show that you can only modify shadow by publish message to $aws/things/thingName/shadow. update-pub-sub-topic show that message body contains a partial request state document.

A request state document has the following format:

{
    "state": {
        "desired": {
            "attribute1": integer2,
            "attribute2": "string2",
            ...
            "attributeN": boolean2
        },
        "reported": {
            "attribute1": integer1,
            "attribute2": "string1",
            ...
            "attributeN": boolean1
        }
    },
    "clientToken": "token",
    "version": version
}

if you want only modify desired status but stay reported status,you should let device publish:

{
  "state": {
    "desired": {
      "msg2": "hello2"
     }
   }
}

If the state of the device changed, you should let device publish:

{
  "state": {
    "reported": {
      "msg1": "hello1"
     }
   }
}