ForbiddenError 403 when getShadow/updateShadow called in AWS IOT

Question

I have the the authenticated user with federated ID. But when I try to access the AWS IOT stuff I get this error which is driving me crazy.

I am following the iot sample

Answer 1

Here are the few reasons why you might be getting error 403

1. In Cognito, there are no appropriate permissions for Update/Get Shadow both for authenticated and unauthenticated pool
2. The ARN of the Cognito Pool id as well as the IoT are incorrect

3. Check the IAM policy and the following policy to the Cognito users, Also for the Cognito user, you have to attach AttachPrincipalPolicy policy to give them appropriate permissions for Get/update the shadow. The policy below should be in the Cognito Auth and UnAuth roles.

   {

   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "iot:AttachPrincipalPolicy"
           ],
           "Resource": [
               "*"
           ]
       }
   ] }