AWS IoT - Connection and publishing operations using paho-mqtt not working - publish-subscribe

Question

Trying to work with AWS IoT, I have the following code that was working yesterday:
import paho.mqtt.client as mqtt
import ssl, random
from time import sleep
mqtt_url = "XXXXXXXX.iot.us-east-2.amazonaws.com"
root_ca = './certs/iotRootCA.pem'
public_crt = './certs/deviceCert.crt'
private_key = './certs/deviceCert.key'
connflag = False
def on_connect(client, userdata, flags, response_code):
global connflag
connflag = True
print("Connected with status: {0}".format(response_code))
def on_publish(client, userdata, mid):
print userdata + " -- " + mid
#client.disconnect()
if __name__ == "__main__":
print "Loaded MQTT configuration information."
print "Endpoint URL: " + mqtt_url
print "Root Cert: " + root_ca
print "Device Cert: " + public_crt
print "Private Key: " + private_key
client = mqtt.Client()
client.tls_set(root_ca,
certfile = public_crt,
keyfile = private_key,
cert_reqs = ssl.CERT_REQUIRED,
tls_version = ssl.PROTOCOL_TLSv1_2,
ciphers = None)
client.on_connect = on_connect
# client.on_publish = on_publish
print "Connecting to AWS IoT Broker..."
client.connect(mqtt_url, port = 8883, keepalive=60)
client.loop_start()
# client.loop_forever()
while 1==1:
sleep(0.5)
print connflag
if connflag == True:
print "Publishing..."
ap_measurement = random.uniform(25.0, 150.0)
client.publish("ActivePower", ap_measurement, qos=1)
print("ActivePower published: " + "%.2f" % ap_measurement )
else:
print "waiting for connection..."
As I said, yesterday this code was working. Today, I am getting the following (there is no connection):
python awsiot-publish.py
Loaded MQTT configuration information.
Endpoint URL: XXXXXXX.iot.us-east-2.amazonaws.com
Root Cert: ./certs/iotRootCA.pem
Device Cert: ./certs/deviceCert.crt
Private Key: ./certs/deviceCert.key
Connecting to AWS IoT Broker...
False
waiting for connection...
False
waiting for connection...
False
waiting for connection...
False
I do not know if there is a problem with AWS IoT... I just think the documentation is deficient: it is not clear how we can use our code...

Answer 1

I believe your problem is that your certificate's policy does not have the proper permissions to connect. If not specified paho genereates a random client_id. You should set the client_id. You also need a policy that allows your certificate to connect using that client id.
{
"Effect": "Allow",
"Action": "iot:Connect",
"Resource":"arn:aws:iot:us-east1:123456789012:client/yourClientIdGoesHere"
}
It can be useful to set your client_id to the same as your thingname. (This is not necessary though.) You can also set the resource in your policy to * and then connect with any client_id:
{
"Effect": "Allow",
"Action": "iot:Connect",
"Resource":"*"
}