MQTT over WebSocket Signature Version 4 http/1.1 403

I have tried everything I found online since the mid 2010s, but nothing seems to work.

I have an IoT Thing that works pretty well over MQTT. I am now trying to connect via web socket to the same Thing.

This is the Policy for that Thing:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish",
        "iot:Receive",
        "iot:PublishRetain"
      ],
      "Resource": "arn:aws:iot:eu-west-1:279332907237:topic/sdk/test/dart"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "arn:aws:iot:eu-west-1:279332907237:topicfilter/sdk/test/dart"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:GetThingShadow",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:DeleteThingShadow",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:UpdateThingShadow",
      "Resource": "*"
    }
  ]
}

This is how I create the Signature v4 with my IAM User's AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY:

const AWSSigV4Signer signer = AWSSigV4Signer();
    // Create the signing scope and HTTP request
    final AWSCredentialScope scope = AWSCredentialScope(
      region: region,
      service: AWSService.iot,
    );
    final AWSHttpRequest request = AWSHttpRequest(
      method: AWSHttpMethod.get,
      uri: Uri(scheme: 'wss', host: endpoint, path: 'mqtt', port: 443),
    );

    const ServiceConfiguration serviceConfig = ServiceConfiguration(
      omitSessionToken: true,
      signBody: true,
    );

    const Duration expiration = Duration(seconds: 3600);

    // Sign and send the HTTP request
    final Uri signedRequest = await signer.presign(
      request,
      credentialScope: scope,
      serviceConfiguration: serviceConfig,
      expiresIn: expiration,
    );

... which outputs wss://a2eqw4se8i5px2-ats.iot.eu-west-1.amazonaws.com:443/mqtt?X-Amz-Date=20260127T191558Z&X-Amz-SignedHeaders=host&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=<THIS_IS_MY_AWS_ACCESS_KEY_ID>%2F20260127%2Feu-west-1%2Fiot%2Faws4_request&X-Amz-Expires=3600&X-Amz-Signature=7d21116970f7cc17eb025648413628cf6a86ce73dca15f54ea6cdf1a3d5060f3

The MQTT client under the hood tries to establish the handshake as follows:

GET /mqtt?X-Amz-Date=20260127T192347Z&X-Amz-SignedHeaders=host&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=<THIS_IS_MY_AWS_ACCESS_KEY_ID>/20260127/eu-west-1/iot/aws4_request&X-Amz-Expires=3600&X-Amz-Signature=3fa6c9ecd5173916e58b13018ea9fb6fa8d43d71efe084d9e9457ac5ca900ce7 HTTP/1.1 
Host: a2eqw4se8i5px2-ats.iot.eu-west-1.amazonaws.com:443
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: bXF0dC0xNzY5NTQxODU5MzI2
Sec-WebSocket-Protocol: mqtt
Sec-WebSocket-Version: 13

... which returns

HTTP/1.1 403 Forbidden
content-type: application/json
content-length: 72
date: Tue, 27 Jan 2026 19:22:09 GMT
x-amzn-RequestId: f66bc55a-f728-59fa-4a86-ff32f45e2d50
connection: keep-alive
x-amzn-ErrorType: ForbiddenException:

{"message":"Forbidden","traceId":"f66bc55a-f728-59fa-4a86-ff32f45e2d50"}

I suspect this has to do with permissions, but everything seems to be in order? I must also say, that documentation to cover this case scenario is virtually non existent. I have found some generic docs here here and here but nothing seems strictly related or explanatory

EDIT: I have been struggling the whole day with this. What I have done:

• created a new IAM user
• provided both Root, and the new IAM user with all the necessary IoT permissions
• provided all IoT related permissions to my IAM group and role
• in IoT Core, created a Role Alias
• tried all possible combinations of the above
• added the below trusted relationship to my Thing Role

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "iot.amazonaws.com",
                "AWS": [
                    "arn:aws:iam::279332907237:user/IoT",
                    "arn:aws:iam::279332907237:root"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Nothing seems to be working.