title: ForbiddenError 403 when getShadow/updateShadow called in AWS IOT
body: <p>I have the the authenticated user with federated ID. But when I try to access the AWS IOT stuff I get this error which is driving me crazy.</p>
  
  <p>I am following the <a href="https://github.com/awslabs/aws-sdk-android-samples/blob/master/AndroidPubSub/src/com/amazonaws/demo/androidpubsub/PubSubActivity.java" rel="nofollow noreferrer"><code>iot sample code</code></a>. All the relevant credentials are correct too.</p>
  
  <pre><code>    `MQTTHelper`
      ....
          credentialsProvider = new CognitoCachingCredentialsProvider(
                          mContext.getApplicationContext(), // context
                          BuildConfig.COGNITO_POOL_ID, // Identity Pool ID
                          MY_REGION // Region
                  );
  
                  Region region = Region.getRegion(MY_REGION);
  
                  mqttManager = new AWSIotMqttManager(clientId, BuildConfig.CUSTOMER_SPECIFIC_ENDPOINT);
                  mqttManager.setKeepAlive(10);
  mAwsIotDataClient = new AWSIotDataClient(credentialsProvider);
          String iotDataEndpoint = BuildConfig.CUSTOMER_SPECIFIC_ENDPOINT;
          mAwsIotDataClient.setEndpoint(iotDataEndpoint);
          mAwsIotDataClient.setRegion(region);
  
          // mqttManager.setMqttLastWillAndTestament(lwt);
  
          mIotAndroidClient = new AWSIotClient(credentialsProvider);
          mIotAndroidClient.setRegion(region);
  
          keystorePath = mContext.getFilesDir().getPath();
          keystoreName = BuildConfig.KEYSTORE_NAME;
          keystorePassword = BuildConfig.KEYSTORE_PASSWORD;
          certificateId = BuildConfig.CERTIFICATE_ID;
  
          // To load cert/key from keystore on filesystem
          try {
              if (AWSIotKeystoreHelper.isKeystorePresent(keystorePath, keystoreName)) {
                  if (AWSIotKeystoreHelper.keystoreContainsAlias(certificateId, keystorePath,
                          keystoreName, keystorePassword)) {
                      Log.d(LOG_TAG, "Certificate " + certificateId
                              + " found in keystore - using for MQTT.");
                      // load keystore from file into memory to pass on connection
                      clientKeyStore = AWSIotKeystoreHelper.getIotKeystore(certificateId,
                              keystorePath, keystoreName, keystorePassword);
                      //btnConnect.setEnabled(true);
                      Log.i(LOG_TAG, "Connected....");
                      //CONNECTED_TO_DEVICE = true;
                  } else {
                      Log.i(LOG_TAG, "Key/cert " + certificateId + " not found in keystore.");
                  }
              } else {
                  Log.i(LOG_TAG, "Keystore " + keystorePath + "/" + keystoreName + " not found.");
              }
          } catch (Exception e) {
              Log.e(LOG_TAG, "An error occurred retrieving cert/key from keystore.", e);
          }
  
  
          if (clientKeyStore == null) {
  
              IS_CERTIFICATE_GENERATED = false;
  
              Log.i(LOG_TAG, "Cert/key was not found in keystore - creating new key and certificate.");
  
              doGenerateNewCertificate();
  
          } else {
  
              IS_CERTIFICATE_GENERATED = true;
              doMqttConnect();
          }
  
  
  
  
      }
  
      private static void doMqttConnect() {
  
          Log.d(LOG_TAG, "clientId = " + clientId);
  
          try {
              mqttManager.connect(clientKeyStore, new AWSIotMqttClientStatusCallback() {
                  @Override
                  public void onStatusChanged(final AWSIotMqttClientStatus status,
                                              final Throwable throwable) {
                      Log.d(LOG_TAG, "Status = " + String.valueOf(status));
  
                      if (mqttManagerConnStatus != null) {
                          //Send Mqtt Manager Status Back
                          mqttManagerConnStatus.onStatusChanged(status, throwable);
                      }
  
  
                  }
  
              });
          } catch (final Exception e) {
              Log.e(LOG_TAG, "Connection error.", e);
  
          }
  </code></pre>
  
  <p>and similarly as mentioned in the sample code I am calling <code>GetShadow()</code> in another class</p>
  
  <pre><code> GetThingShadowRequest getThingShadowRequest = new GetThingShadowRequest() .withThingName(thingName);
  
                  GetThingShadowResult result = mDashboard.mqttHelper.doGetAwsIotDataClient()
                          .getThingShadow(getThingShadowRequest);
  
                  byte[] bytes = new byte[result.getPayload().remaining()];
                  result.getPayload().get(bytes);
  
                  String resultString = new String(bytes);
                  return new AsyncTaskResult&lt;String&gt;(resultString);
  </code></pre>
  
  <p>I am able to get the <code>KMS</code> working so there is no problem with the authenticated (federated Id). The only source of information I get on AWS IOT is just <a href="https://docs.aws.amazon.com/iot/latest/developerguide/thing-groups.html" rel="nofollow noreferrer">this</a> which is not helpful from client perspective. 
  Is it the issue with the AWS IOT configuration or code issue? I have to subscribe to the Thing Group, is there anything else I need to do to subscribe to the group? 
  This is the Thing Group ARN that I needs to subscribe to 
  <strong><code>arn:aws:iot:us-east-1:XXXXXXXXXX:thinggroup/A_GROUP</code></strong></p>
  
  <p><strong>Stack Trace</strong></p>
  
  <pre><code>getShadowTask
      com.amazonaws.AmazonServiceException: null (Service: AWSIotData; Status Code: 403; Error Code: ForbiddenException; Request ID: f78eea4d-9053-4b19-1840-297dd67c2667)
          at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(AmazonHttpClient.java:730)
          at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:405)
          at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:212)
          at com.amazonaws.services.iotdata.AWSIotDataClient.invoke(AWSIotDataClient.java:571)
          at com.amazonaws.services.iotdata.AWSIotDataClient.getThingShadow(AWSIotDataClient.java:406)
          at com.lyrebird.abc.device.MyDevicesFragment_RV_Adapter$GetShadowTask.doInBackground(MyDevicesFragment_RV_Adapter.java:519)
          at com.lyrebird.abc.device.MyDevicesFragment_RV_Adapter$GetShadowTask.doInBackground(MyDevicesFragment_RV_Adapter.java:497)
          at android.os.AsyncTask$2.call(AsyncTask.java:295)
          at java.util.concurrent.FutureTask.run(FutureTask.java:237)
          at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:234)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
          at java.lang.Thread.run(Thread.java:818)
  06-18 06:00:54.029 7489-7489/com.lyrebird.abc E/com.lyrebird.abc.device.MyDevicesFragment_RV_Adapter.GetShadowTask: getShadowTask
      com.amazonaws.AmazonServiceException: null (Service: AWSIotData; Status Code: 403; Error Code: ForbiddenException; Request ID: f78eea4d-9053-4b19-1840-297dd67c2667)
          at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(AmazonHttpClient.java:730)
          at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:405)
          at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:212)
          at com.amazonaws.services.iotdata.AWSIotDataClient.invoke(AWSIotDataClient.java:571)
          at com.amazonaws.services.iotdata.AWSIotDataClient.getThingShadow(AWSIotDataClient.java:406)
          at com.lyrebird.abc.device.MyDevicesFragment_RV_Adapter$GetShadowTask.doInBackground(MyDevicesFragment_RV_Adapter.java:519)
          at com.lyrebird.abc.device.MyDevicesFragment_RV_Adapter$GetShadowTask.doInBackground(MyDevicesFragment_RV_Adapter.java:497)
          at android.os.AsyncTask$2.call(AsyncTask.java:295)
          at java.util.concurrent.FutureTask.run(FutureTask.java:237)
          at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:234)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
          at java.lang.Thread.run(Thread.java:818)
  </code></pre>
  
  <p><strong>Policy</strong></p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "iot:*",
          "lambda:*"
        ],
        "Resource": [
          "*"
        ]
      }
    ]
  }
  </code></pre>