IAM User Permisions

Question

I am trying to create an IAM user where I can restrict each account to be able to create a thing and a certificate and register them but whenever I want to list the things available and certificates I want only to list his own generated certificates and things how is this possible ? The below rule template that I have generated allows me to create a thing and a certificate and to register them but when it comes to listing things and certificates it tells me that permission is denied cannot do the following action unless I add the "iot:ListThings", and "iot:ListCertificates"  under the list of actions having full access on resources (*) but in this case it lists all the things and certificates available on my root account.
IAM Rule:
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"iot:CreateKeysAndCertificate",
				"iot:DescribeCertificate",
				"iot:UpdateCertificate",
				"iot:CreateThing",
				"iot:DescribeThing",
				"iot:UpdateThing",
				"iot:DeleteThing",
				"iot:ListThings",
				"iot:AttachThingPrincipal",
				"iot:DetachThingPrincipal",
				"iot:ListThingGroupsForThing",
				"iot:ListCertificates"  
			],
			"Resource": [
				"arn:aws:iot:::thing/${aws:username}_*",
				"arn:aws:iot:::thinggroup/*",
				"arn:aws:iot:::cert/*"
			]
		},
		{
			"Effect": "Allow",
			"Action": [
				"iot:CreateKeysAndCertificate",
				"iot:RegisterThing",
				"iot:ListThingPrincipals",
			],
			"Resource": "*"
		}
	]
}

Riku_Kobayashi · Answer

Hello.

As far as I can see from the document below, I don't think it is possible to restrict the display based on the user who created the resource.  
https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html

This is because the "Resource types" listed in the document for "iot:ListThings" and "iot:ListCertificates" is blank, so nothing can be displayed unless it is set to "*".  
Therefore, I think it will not work unless the IAM policy is set as follows.  
```
{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Effect": "Allow", 
            "Action": [ 
                "iot:CreateKeysAndCertificate", 
                "iot:DescribeCertificate", 
                "iot:UpdateCertificate", 
                "iot:CreateThing", 
                "iot:DescribeThing", 
                "iot:UpdateThing", 
                "iot:DeleteThing", 
                "iot:AttachThingPrincipal", 
                "iot:DetachThingPrincipal", 
                "iot:ListThingGroupsForThing"
            ], 
            "Resource": [ 
                "arn:aws:iot:::thing/${aws:username}_", 
                "arn:aws:iot:::thinggroup/*", 
                "arn:aws:iot:::cert/*" 
            ] 
        }, 
        { 
            "Effect": "Allow", 
            "Action": [ 
                "iot:CreateKeysAndCertificate", 
                "iot:RegisterThing", 
                "iot:ListThingPrincipals",
                "iot:ListThings",
                "iot:ListCertificates"
            ], 
            "Resource": "*" 
        }
    ] 
}
```

IAM User Permisions

Relevant content