AWS IoT Android application over MQTT throws MqttException (0) - java.io.IOException: Already connected

Question

I am trying to use \'Authenticate using Cognito-Identity with Cognito user pool\' in my Android application. My Cognito user pool authentication works well, when I run that

Answer 1

I was also getting same error -

Feb 27, 2019 10:23:09 AM com.amazonaws.services.iot.client.mqtt.AwsIotMqttConnectionListener onFailure
WARNING: Connect request failure
MqttException (0) - java.io.IOException: Already connected
    at org.eclipse.paho.client.mqttv3.internal.ExceptionHelper.createMqttException(ExceptionHelper.java:38)
    at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:664)
    at java.lang.Thread.run(Thread.java:748)
Caused by: java.io.IOException: Already connected
    at java.io.PipedOutputStream.connect(PipedOutputStream.java:100)

but the problem was different.

First of all, you do not need to call attachPrincipalPolicy from code. You can use the command line as well. You can do something like -

aws iot attach-principal-policy --principal us-east-1:1c973d17-98e6-4df6-86bf-d5cedc1fbc0d --policy-name "thingpolicy" --region us-east-1 --profile osfg

You will get the principal ID from identity browser of your identity pool. Now lets come to the error -

To successfully connect to mqtt with authenticated Cognito credentials, you need 2 correct policies -

1. Authenticated role corresponding to your identity pool should allow all mqtt operations.
2. AWS IoT policy should allow the same operations and you need to associate your cognito identity with this policy. We use attachPrincipalPolicy to do so.

If anyone step is missed we get above error. I agree the error is misleading - Already connected makes no sense to me for this. I would normally think it has to do with clientId, which should be unique. But anyways hopefully AWS folks would make this better at some point.

For my particular case issue was point 1. Though my IoT policy had all the required permissions, the auth role corresponding to the identity pool did not. So make sure you do that.

I have created a youtube video to show this as well: https://www.youtube.com/watch?v=j2KJVHGHaFc