使用“client-iot-data-plane”通过 AWS-SDK v3 获取 Thing Shadow

Question

我需要在 lambda 中获取某个事物的影子。由于我们从 V2 升级到 V3 SDK，我们在使用“IoT 数据平面客户端”与影子交互时遇到了问题，当我们尝试发送“GetThingShadowCommand”时，它返回 403 ForbiddenException。

import {
    GetThingShadowCommand, 
    GetThingShadowCommandInput, 
    IoTDataPlaneClient 
    } from "@aws-sdk/client-iot-data-plane";

[...]


public async getData(dispenserId: string): Promise<object> {
                try {
                    const dispenser = await Dispenser.findById(dispenserId)
                    const iotDataPlaneClient = new IoTDataPlaneClient({
                        region: process.env.DEPLOYMENT_REGION
                    });
                    const input: GetThingShadowCommandInput = { // GetThingShadowRequest
                        thingName: dispenser.serial, // required
                        shadowName: "Device_Shadow",
                    };
                    const command = new GetThingShadowCommand(input);
                    const response = await iotDataPlaneClient.send(command);
                    const shadow: object = JSON.parse(response.payload.toString())
                    return response.payload
                } catch (err) {
                    console.log('!!!ERROR CAUGHT IN GET DATA SERVICE!!!')
                    console.log(JSON.stringify(err, null, 2))
                    return err
                }
            }

在无服务器文件中，我们允许物联网操作

[...]
{
                    Effect: "Allow",
                    Action: [
                        "iot:Publish",
                        "iot:GetThingShadow",
                        "iot:ListNamedShadowsForThing",
                        "iot:UpdateThingShadow",
                        "iot:DeleteThingShadow",

                    ],
                    Resource: ["*"]
                }
[...]

这是打印的完整错误：

{
    "name": "ForbiddenException",
    "$fault": "client",
    "$metadata": {
        "httpStatusCode": 403,
        "requestId": "ec8d4b5d-1ae5-77ce-7166-9cbfeb1df1fa",
        "attempts": 1,
        "totalRetryDelay": 0
    },
    "message": "Forbidden",
    "traceId": "ec8d4b5d-1ae5-77ce-7166-9cbfeb1df1fa"
}

我希望收到的影子是

{
  "state": {
    "desired": {
        "prop1":"value1",
        "prop2":"value2"
    },
    "reported": {
        "prop1":"value1",
        "prop2":"value2"

    }
  }
}

或者类似的东西

Answer 1

当与

iot

交互所需的所有权限并未在

serverless.yml

中定义时，我遇到了同样的问题。

我建议有这样的东西：

    - Effect: Allow
      Action:
        - "iot:Get*"
        - "iot:List*"
        - "iot:Describe*"
        - "iot:Subscribe"
        - "iot:Connect"
        - "iot:Publish"
        - "iot:Update*"
      Resource: "*"