I’m trying to allow my cognito user to subscribe to IoT mqtt websocket. The connection keeps closing and I have this permissions:

this.auth.attachPermissionsForAuthUsers([
      api,
      'iot:*',
      // 'iot:Connect',
      // 'iot:Subscribe',
      // 'iot:Receive',
      new iam.PolicyStatement({
        actions: ['s3:*'],
        effect: iam.Effect.ALLOW,
        resources: [
          `${uploadsBucket.bucketArn}/private/\${<http://cognito-identity.amazonaws.com:sub|cognito-identity.amazonaws.com:sub>}/*`,
        ],
      }),
    ]);

Am I missing something here?

That policy gives access to an S3 bucket, not MQTT.

Yes, I checked it out, I’m trying to make it work with SST and CDK without external libraries and tools.

Copy and paste whatever is useful then.

I’m actually some steps further. I think I understand how it works now. IoT Core needs me to attach a policy with for each user that will subscribe to my wss. To do that, I can either use the CLI (not very useful) or a lambda with the identityId I get when a user makes a call. None of the cognito triggers have the identityId. But I can get that ID if my front end calls an API endpoint or -apparently but not confirmed - if the post confirm account trigger makes an API call to an API Gateway then it will setup the identityId (to be confirmed)