PubSub Websocket: "AMQJS0008I Socket closed." when trying to subscribe

[BenediktMiller]

Describe the bug
I followed the tutorial to create Auth for my React App, then I followed the tutorial on using PubSub with AWS IoT. The first Problem I encountered was that using the pubsub endpoint: wss://xxxxxxx-iot.eu-central-1.amazonaws.com/mqtt resultet in a "legancy certificate error" (I am using chrome) so i replaced the endpoint with wss://xxxxxxx-ats.iot.eu-central-1.amazonaws.com/mqtt. Now as soon as I try to subscribe I get the following error: {invocationContext: undefined, errorCode: 8, errorMessage: "AMQJS0008I Socket closed."}

I have attached the Policy using the command from the tutorial, but since attach-principal-policy is deprecated I also tried: aws iot attach-policy --policy-name 'myIOTPolicy' --target 'eu-central-1:xxxxxxxxxxxxxxxxxxx'

To Reproduce

1. Follow all the steps from the tutorial for setting up a react app, adding auth and using PubSub.
   Expected behavior
   A clear and concise description of what you expected to happen.

Desktop (please complete the following information):

• OS: WSL
• Browser Chrome
• Version 71.0.3578.98

[kevin-mitchell]

Same issue here. I added a bunch more detail in this issue / comment: aws-amplify/amplify-js#2739 (comment)

[elorzafe]

@kevin-mitchell I tried this and it worked for me.

Lets start connecting unauth users.
I am assuming you have an identityPool with unauthenticated identities enabled.

First step, need to know the name of the unauth role for the identityPool, (if you use aws cli, you can do run this (replace with yours) aws cognito-identity get-identity-pool-roles --identity-pool-id "<identityPoolId>" the role name is after the /

Second step, go IAM console, navigate to roles to search the unauth role and click on it.

Third step, click on Add inline policy, select JSON tab and paste the following (replace and :P)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iot:Connect",
                "iot:Publish",
                "iot:Subscribe",
                "iot:Receive"
            ],
            "Resource": [
                "arn:aws:iot:<your region>:<your aws account id>:*/*"
            ]
        }
    ]
}

This should solve the problem for unauthenticated identities on service permissions. Now to integrate this on your app using Amplify you can do this. (This is an example using create-react-app with aws-amplify installed)

import React, { Component } from 'react';
import logo from './logo.svg';
import './App.css';

import Amplify, { PubSub } from 'aws-amplify';
import { AWSIoTProvider } from '@aws-amplify/pubsub/lib/Providers';

Amplify.configure({
  Auth: {
    region: 'us-east-2',
    identityPoolId: "us-east-2:xxxxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  }
})

// Apply plugin with configuration
Amplify.addPluggable(new AWSIoTProvider({
  aws_pubsub_region: 'us-east-2',
  aws_pubsub_endpoint: 'wss://xxxxxxxxxxxxxxxxxx-ats.iot.us-east-2.amazonaws.com/mqtt',
}));

class App extends Component {

  componentDidMount(){
    PubSub.subscribe('myTopic').subscribe({
      next: data => console.log('Message received', data),
      error: error => console.error(error),
      close: () => console.log('Done'),
  });
  }

  publishTopic(){
    PubSub.publish('myTopic', 'testing testing...');
  }

  render() {
    return (
      <div className="App">
        <button onClick={this.publishTopic}>public to topic</button>
      </div>
    );
  }
}

export default App;

Now for auth users is the same procedure as above, but you need to do this extra steps.

First create IAM polcies for AWS IoT. Go to IoT Core and choose Secure from the left navigation pane. Then navigate to Create Policy. The following myIOTPolicy policy will allow full access to all the topics.
Name: myIOTPolicy
Action: iot:*
Resource arn: arn:aws:iot:<your region>:<your aws account id>:*/*

Second add Amplify Auth Category to your app and get the current user identityId

import { Auth } from 'aws-amplify';

//...

   Auth.currentCredentials().then((info) => {
      console.log(info._identityId);
    });

Final step: With the identityId in hand do this aws iot attach-principal-policy --policy-name 'myIOTPolicy' --principal '<identityId>' (check the policy name and identityId from previous)

I hope this helps

[kevin-mitchell]

Thank you so much @elorzafe ! This did it!

Specifically, the only thing that I was missing was adding the inline policy to the authenticated role for the identity pool. I'm not sure if that was something that I should have just known, or if it's something worth adding to the documentation (or if it's already in the documentation but I just didn't see it?).

Again, thank you!

[elorzafe]

@kevin-mitchell I am very happy that this worked for you, I will send a PR updating that part of the docs.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[nino-moreton]

@kevin-mitchell I am very happy that this worked for you, I will send a PR updating that part of the docs.

Hey this worked for me but is there a way to be able to authorize the whole auth users? With your method / fix, I would have to go and run the aws cli command for all my authenticated users.

I've already tried using the aws cli command using the identity pool id in an attempt to allow all of my auth users but to no avail.

[elorzafe]

@nino-moreton currently that is the way that IoT works, if you like you can use AppSync and not worry about that issue. More info here