AWS IoT: Receive vs Subscribe
iot:Subscribe lets an MQTT client create a topic subscription. iot:Receive lets AWS IoT Core deliver matching messages to that client.
In AWS IoT Core, iot:Subscribe and iot:Receive protect two different steps in MQTT message delivery. iot:Subscribe lets a client register interest in a topic filter. iot:Receive lets the broker deliver matching messages to that subscribed client.
| Permission | What it controls | Practical effect |
|---|---|---|
iot:Subscribe | Creating the MQTT subscription | The client can ask to receive messages for a topic filter |
iot:Receive | Receiving matching messages | AWS IoT Core can forward messages from subscribed topics to the client |
iot:Subscribe
This is the permission a client needs to register its interest in receiving messages on one or more MQTT topics. When a client wants to be notified of messages published to topics like my/device/data, it needs the iot:Subscribe permission for those specific topic filters.
Without this permission, the broker will not allow the client to create the subscription.
iot:Receive
Once a client has successfully subscribed to a topic, iot:Receive governs the actual delivery of messages from the AWS IoT message broker to the subscribed client.
So even if a client has the iot:Subscribe permission for my/device/data and has an active subscription, it still needs the iot:Receive permission on that topic before the broker can forward those messages.