CODEWITHSUNDEEP
amazon-web-servicesaws-sdkiotaws-iot
Robby
Robby

Reputation: 391

AWS IOT - Credential should be scoped to correct service

I am trying to access a simple AWS IOT REST service but I have not been able to do so successfully yet. Here is what I did.

  1. I created an iam user in my aws and downloaded the access key and secret key
  2. Logged into AWS IOT with that user and created a "thing"
  3. From the thing's property I found the REST URL for the shadow
  4. Used Postman with the new "aws signature" feature and provided it with the access key, secret key, region (us-east-1) and service name (iot)

  5. Tried to "GET" the endpoint and this is what I got -

    { "message": "Credential should be scoped to correct service. ", "traceId": "be056198-d202-455f-ab85-805defd1260d" }

  6. I thought there is something wrong with postman so I tried using aws-sdk-sample example of connecting to S3 and changed it to connect to the IOT URL. Here is my program snippet (Java)

    String awsAccessKey = "fasfasfasdfsdafs";
String awsSecretKey = "asdfasdfasfasdfasdfasdf/asdfsdafsd/fsdafasdf";

URL  endpointUrl = null;
String regionName = "us-east-1";
try {
    endpointUrl = new URL("https://dasfsdfasdf.iot.us-east-1.amazonaws.com/things/SOMETHING/shadow");
}catch (Exception e){
    e.printStackTrace();
}
Map<String, String> headers = new HashMap<String, String>();
headers.put("x-amz-content-sha256", AWSSignerBase.EMPTY_BODY_SHA256);

AWSSignerForAuthorizationHeader signer = new AWSSignerForAuthorizationHeader(
        endpointUrl, "GET", "iot", regionName);
String authorization = signer.computeSignature(headers,
        null, // no query parameters
        AWSSignerBase.EMPTY_BODY_SHA256,
        awsAccessKey,
        awsSecretKey);

// place the computed signature into a formatted 'Authorization' header
// and call S3
headers.put("Authorization", authorization);
String response = HttpUtils.invokeHttpRequest(endpointUrl, "GET", headers, null);
System.out.println("--------- Response content ---------");
System.out.println(response);
System.out.println("------------------------------------");

This gives me the same error - 

--------- Request headers ---------
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Authorization: AWS4-HMAC-SHA256 Credential=fasfasfasdfsdafs/20160212/us-east-1/iot/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=3b2194051a8dde8fe617219c78c2a79b77ec92338028e9e917a74e8307f4e914
x-amz-date: 20160212T182525Z
Host: dasfsdfasdf.iot.us-east-1.amazonaws.com
--------- Response content ---------
{"message":"Credential should be scoped to correct service. ","traceId":"cd3e0d96-82fa-4da5-a4e1-b736af6c5e34"}
------------------------------------

Can someone tell me what I am doing wrong please? AWS documentation does not have much information on this error. Please help

Upvotes: 23

Views: 25990

Answers (4)

Alok Singh
Alok Singh

Reputation: 508

In your 4th step, don't fill anything for Service Name. Postman will default the value with execute-api.

Hope this works!

Upvotes: 3

kartick shaw
kartick shaw

Reputation: 1013

Its basically due to Service name is not given correctly you can use service Name = 'iotdata' instead of iot.

If you user Key management then Service Name would be kms. For EC2 Service Name would be ec2 etc.

Upvotes: 0

Firas Al Mannaa
Firas Al Mannaa

Reputation: 926

Sign your request with iotdata instead if iot
example: 

AWSSignerForAuthorizationHeader signer = new AWSSignerForAuthorizationHeader(
    endpointUrl, "GET", "iotdata", regionName);

Upvotes: 21

gboda
gboda

Reputation: 1494

Use the AWS IoT SDK for Node.js instead. Download the IoT Console generated private key and client cert as well as the CA Root cert from here. Start with the scripts in the examples directory.

Upvotes: -4

Related Questions