Unable to create valid signed url for IoT websockets connection

[franksl]

Hi all,
I'm trying to connect to some IoT topics by using MQTT+websocket connection.
The code that follows is for creating a v4 signed url to be able to connect to the service by using temporary credentials that come from a Cognito Identity. I set the temporary credentials as environment variables (access key, secret key, session token).

I took the idea from this sample project: https://github.com/aws-samples/aws-iot-wss-ts-client which works correctly on my machine, so the credentials are good.
What I receive as an answer is this, when trying to connect:

Error = Websocket(Http(Response { status: 403, version: HTTP/1.1, headers: {"content-type": "application/json", "content-length": "72", "date": "Fri, 06 Dec 2024 13:43:28 GMT", "x-amzn-requestid": "d1682d01-1d71-7551-8466-4f63ae5d147a", "connection": "keep-alive", "x-amzn-errortype": "ForbiddenException:"}, body: Some([123, 34, 109, 101, 115, 115, 97, 103, 101, 34, 58, 34, 70, 111, 114, 98, 105, 100, 100, 101, 110, 34, 44, 34, 116, 114, 97, 99, 101, 73, 100, 34, 58, 34, 100, 49, 54, 56, 50, 100, 48, 49, 45, 49, 100, 55, 49, 45, 55, 53, 53, 49, 45, 56, 52, 54, 54, 45, 52, 102, 54, 51, 97, 101, 53, 100, 49, 52, 55, 97, 34, 125]) }))

which is a 403 - Forbidden error. My suspect is that the signed url is wrong but I checked all the parameters many times and can't understand which might be the problem.

Here's my sample code:

use std::{error::Error, str, time::{Duration, SystemTime}};
use aws_config::{BehaviorVersion, SdkConfig};
use aws_credential_types::{provider::ProvideCredentials};
use aws_sigv4::{http_request::{sign, SignableBody, SignableRequest, SignatureLocation, SigningSettings}, sign::{self, v4::SigningParams}};
use aws_smithy_runtime_api::client::identity::Identity;
use http::Request;
use rumqttc::{AsyncClient, MqttOptions, QoS, Transport};
use tokio::time;

#[tokio::main]
async fn main() -> Result<(), Box<dyn Error>> {
    let config = aws_config::defaults(BehaviorVersion::latest()).load().await;
    let endpoint = String::from("wss://myendpoint-ats.iot.eu-west-1.amazonaws.com/mqtt");

    let uri = get_url(&endpoint, &config, "eu-west-1").await;

    let mut mqopt = MqttOptions::new("client-cog", &uri, 443);
    mqopt.set_transport(Transport::wss_with_default_config());
    mqopt.set_keep_alive(Duration::from_secs(5));

    let (client, mut eventloop) = AsyncClient::new(mqopt, 10);
    tokio::task::spawn(async move {
        requests(client).await;
        time::sleep(Duration::from_secs(3)).await;
    });

    loop {
        let event = eventloop.poll().await;
        match event {
            Ok(notif) => {
                println!("Event = {notif:?}");
            }
            Err(err) => {
                println!("Error = {err:?}");
                return Ok(());
            }
        }
    }
}

async fn requests(client: AsyncClient) {
    client
        .subscribe("test/topic/response", QoS::AtMostOnce)
        .await
        .unwrap();

    for i in 1..=10 {
        client
            .publish("test/topic", QoS::ExactlyOnce, false, vec![1; i])
            .await
            .unwrap();

        time::sleep(Duration::from_secs(1)).await;
    }

    time::sleep(Duration::from_secs(120)).await;
}


async fn get_url(endpoint: &str, config: &SdkConfig, region: &str) -> String {
    let mut signingsettings = SigningSettings::default();
    signingsettings.signature_location = SignatureLocation::QueryParams;
    signingsettings.expires_in = Some(Duration::from_secs(3600));
    let crprov = config.credentials_provider().unwrap().provide_credentials().await.unwrap();
    let ident = Identity::new(crprov, Some(SystemTime::now() + Duration::from_secs(3600)));
    let sigparams = SigningParams::builder()
        .identity(&ident)
        .region(region)
        .name("iotdevicegateway")
        .time(SystemTime::now())
        .settings(signingsettings)
        .build()
        .unwrap()
        .into();
    let sigreq = SignableRequest::new(
        "GET",
        endpoint,
        std::iter::empty(),
        SignableBody::Bytes(&[])
    ).unwrap();
    let (siginst, sig) = sign(sigreq,  &sigparams).unwrap().into_parts();
    let mut req = Request::builder()
        .uri(String::from(endpoint))
        .body(())
        .unwrap();
    println!("siginst: {siginst:?}");
    println!("sig: {sig:?}");
    siginst.apply_to_request_http1x(&mut req);
    let uri = req.uri().to_string();
    println!("{uri}");
    uri
}

Thanks,
Frank