In AWS IoT it is possible to attach multiple things to a single certificate. Also the Device SDKs support attaching multiple devices/things to the same IoT client.
How can a policy be defined for such a client to allow only for topics belonging to the shadows for the attached things?
A policy variable ${iot:Connection.Thing.ThingName} exists, but that will only work for the thing matching the client id, but it doesn't work for other attached things. The policy variable ${iot:Connection.Thing.IsAttached} on the other hand doesn't seem useable within the Resource section for specific topics.
In our case not all of our things are connected to AWS IoT directly, so we would like to interact with multiple thing shadows from within the same IoT client/certificate, which acts as an IoT Gateway. We do have a hook where the (un-)linking happens, but updating the policy there to add things "hard-coded" doesn't feel right.
What would be a good approach to keep this setup secure? Allowing access to all topics for linked things and denying access to others?
We are open to suggestions for a different approach on implementing this single client, multiple things/shadows interactions securely.