Not able to connect to MQTT with browser - connection establish stalled

[croraf]

Describe the bug

I'm trying a code sample provided in the repo browser/pub_sub.

I'm identifying through Cognito identity pool. I set to allow Unauthenticated identities. I created and assigned a new role to both unauthenticated and authenticated identities. That role was created with default policy document.

After I run the application I see in Cognito that the identity has been created as anonymous identity.

Everything seems to be executed properly but the connection does not get established and instead enters in a "pending state" (reconnecting infinitely, check below image),

I did enter the region and endpoint of IoT Core.

export const AWS_REGION = "eu-west-1";
export const AWS_IOT_ENDPOINT = "...-ats.iot.eu-west-1.amazonaws.com";

The endpoint is the one I found in https://eu-west-1.console.aws.amazon.com/iot/home?region=eu-west-1#/connectdevice

Also in https://eu-west-1.console.aws.amazon.com/iot/home?region=eu-west-1#/policyhub I have created a policy with this

Expected Behavior

Connection establish should either work or report a meaningful error.

Current Behavior

It just repeatedly tries to make a WS connection. It doesn't throw an error (provides a message on why it fails).

Reproduction Steps

Run the snippet.

Possible Solution

No response

Additional Information/Context

No response

SDK version used

1.18.11

Environment details (OS name and version, etc.)

Ubuntu 22.04 (Chrome 108 browser)

[croraf]

As I expected the reason was security.
I edited permissions to the role that was returned from Cognito.
https://us-east-1.console.aws.amazon.com/iamv2/home?region=eu-west-1#/roles

For example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iot:Connect",
                "iot:Subscribe"
            ],
            "Resource": "*"
        }
    ]
}

Perhaps would be good to add a section that this also has to be adjusted in AWS IAM service.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[jmklix]

Thanks for pointing this out. I can reproduce the same error and I'm looking into a solution.

[croraf]

@jmklix In the code samples documentation I suggest to add notes about IAM role permissions that have to be set in order to run the samples. (per sample would be best)

[croraf]

Also, I don't know if it is possible that the WS throws with an error, rather than stalling, when it cannot connect due to permission failure.

Error thrown would ideally be like the following:

"iot:connect and iot:receive" permissions are missing thus connection cannot be established

[jmklix]

I will work on adding the IAM role permissions to the samples documentation.

As for adding the warning, that currently can't be done with how IoT Core works. This is because when permissions are not valid it just doesn't respond with any message. So the sample (and the js-v2 sdk) has no way of knowing why the connection isn't successful.