AWS IoT closes mqtt connection after Handshake - amazon-web-services

Question

I have an implementation which uses AWS SDK to connect AWS IoT. It works well on Linux.
I am trying to port it to FreeRTOS based embedded system.
mbedtls is used in AWS SDK with ssl wrapper.
There are small modification on mbedtls side (I provide time from sntp to mbedtls).
When I enabled mbedtls debugs, I am seeing that everything is fine and handshake is completed. But after handshake I am getting connection close message from AWS SDK.
ssl_cli.c : 3303 - client state: MBEDTLS_SSL_FLUSH_BUFFERS (14)
ssl_cli.c : 3303 - client state: MBEDTLS_SSL_HANDSHAKE_WRAPUP (15)
ssl_tls.c : 5024 - <= handshake wrapup
ssl_tls.c : 6346 - <= handshake
ssl_tls.c : 2701 - => write record
ssl_tls.c : 1258 - => encrypt buf
ssl_tls.c : 1400 - before encrypt: msglen = 125, including 0 bytes of padding
ssl_tls.c : 1560 - <= encrypt buf
ssl_tls.c : 2838 - output record: msgtype = 23, version = [3:3], msglen = 141
ssl_tls.c : 2416 - => flush output
ssl_tls.c : 2435 - message length: 146, out_left: 146
ssl_tls.c : 2441 - ssl->f_send() returned 146 (-0xffffff6e)
ssl_tls.c : 2460 - <= flush output
ssl_tls.c : 2850 - <= write record
ssl_tls.c : 6883 - <= write
ssl_tls.c : 6514 - => read
ssl_tls.c : 3728 - => read record
ssl_tls.c : 2208 - => fetch input
ssl_tls.c : 2366 - in_left: 0, nb_want: 5
ssl_tls.c : 2390 - in_left: 0, nb_want: 5
ssl_tls.c : 2391 - ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
ssl_tls.c : 2403 - <= fetch input
ssl_tls.c : 3488 - input record: msgtype = 21, version = [3:3], msglen = 26
ssl_tls.c : 2208 - => fetch input
ssl_tls.c : 2366 - in_left: 5, nb_want: 31
ssl_tls.c : 2390 - in_left: 5, nb_want: 31
ssl_tls.c : 2391 - ssl->f_recv(_timeout)() returned 26 (-0xffffffe6)
ssl_tls.c : 2403 - <= fetch input
ssl_tls.c : 1576 - => decrypt buf
ssl_tls.c : 2051 - <= decrypt buf
ssl_tls.c : 3961 - **got an alert message, type: [1:0]**
ssl_tls.c : 3976 - **is a close notify message**
As I read, "got an alert message, type: [1:0]" means AWS closes the connection but why and what does it mean?
I saw an "Application Data" entry in the Wireshark. So probably I am getting AWS Close alert in the middle of Application data transaction.
I also saw a comment like "it means certificate is not permissive enough for AWS" but I am using same certificates for both Linux and embedded side.
Any idea. How can I debug it?

Answer 1

I would recommend to triple check your policy (and certificates and the links between them and your thing).
I had the same issue and the solution was to change the policy from:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iot :*",
"Resource": "*"
}
]
}
to:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iot:*",
"Resource": "*"
}
]
}
i.e.: The "Action" string has lost the space character.