Greengrass subscribe to wildcard topic - authorization failure

Question

We are attempting to subscribe to a wildcard topic: `test/things/+/topic`

Our accessControl has the following poicy:

```
"accessControl": {
  "aws.greengrass.ipc.pubsub": {
    "com.component.test:pubsub:1": {
      "policyDescription": "test policy",
      "operations": [
        "aws.greengrass#SubscribeToTopic"
      ],
      "resources": [
        "test/things/+/topic"
      ]
    }
  }
}
```

But we're getting the following error saying the component is not authorized to subscribe to that topic:
```
2023-10-27T21:54:49.498Z [INFO] (Copier) com.component.test: stdout. {'time':'2023-10-27 14:54:49,498', 'name': 'awsiot.eventstreamrpc', 'level': '20', 'msg': ' received #1 APPLICATION_ERROR [Header(':content-type', 'application/json', ), Header('service-model-type', 'aws.greengrass#UnauthorizedError', ), Header(':message-type', 1, ), Header(':message-flags', 2, ), Header(':stream-id', 1, )] b'{"message":"Principal com.component.test is not authorized to perform aws.greengrass.ipc.pubsub:aws.greengrass#SubscribeToTopic on resource test/things/+/topic","_service":"aws.greengrass#GreengrassCoreIPC","_message":"*Principal com.component.test is not authorized to perform aws.greengrass.ipc.pubsub:aws.greengrass#SubscribeToTopic on resource test/things/+/topic*","_errorCode":"UnauthorizedError"}''}. {scriptName=services.com.component.test.lifecycle.Run.Script, serviceName=com.component.test, currentState=RUNNING}
```

This code works when we don't use wildcards.

Using Nucleus 2.11.2 and awsiotsdk==1.11.9, which supports Wildcards per https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-publish-subscribe.html

MichaelDombrowski-AWS · Accepted Answer

Hello,

Please make sure the access control is properly formed. What you posted excludes the service which must be `aws.greengrass.ipc.pubsub`. See the examples provided in https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-publish-subscribe.html#ipc-publish-subscribe-authorization.

Ex:

```
"aws.greengrass.ipc.pubsub": {
  "com.component.test:pubsub:1": {
    "policyDescription": "test policy",
    "operations": [
      "aws.greengrass#SubscribeToTopic"
    ],
    "resources": [
      "test/things/+/topic"
    ]
  }
}
```

If you are changing the default configuration in your component, then make sure that you deploy the new default configuration values by using `reset: [""]` in the deployment configuration update.

Also ensure that the policy name is unique within the device.

Cheers,

Michael

Greengrass subscribe to wildcard topic - authorization failure

Relevant content