+Sample Policy
+
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": "iot:Publish",
+ "Resource": [
+ "arn:aws:iot:<region>:<account>:topic/$aws/commands/<device_type>/<device_id>/executions/*/response/json",
+ ]
+ },
+ {
+ "Effect": "Allow",
+ "Action": "iot:Receive",
+ "Resource": [
+ "arn:aws:iot:<region>:<account>:topic/$aws/commands/<device_type>/<device_id>/executions/*/request/*",
+ "arn:aws:iot:<region>:<account>:topic/$aws/commands/<device_type>/<device_id>/executions/*/response/accepted/json",
+ "arn:aws:iot:<region>:<account>:topic/$aws/commands/<device_type>/<device_id>/executions/*/response/rejected/json"
+ ]
+ },
+ {
+ "Effect": "Allow",
+ "Action": "iot:Subscribe",
+ "Resource": [
+ "arn:aws:iot:<region>:<account>:topicfilter/$aws/commands/<device_type>/<device_id>/executions/*/request/*",
+ "arn:aws:iot:<region>:<account>:topicfilter/$aws/commands/<device_type>/<device_id>/executions/*/response/accepted/json",
+ "arn:aws:iot:<region>:<account>:topicfilter/$aws/commands/<device_type>/<device_id>/executions/*/response/rejected/json"
+ ]
+ },
+ {
+ "Effect": "Allow",
+ "Action": "iot:Connect",
+ "Resource": "arn:aws:iot:<region>:<account>:client/<mqtt_client_id>"
+ }
+ ]
+}
+
+
+Replace with the following with the data from your AWS account:
+* ``: The AWS IoT Core region where you created your AWS IoT Core thing you wish to use with this sample. For example `us-east-1`.
+* ``: Your AWS IoT Core account ID. This is the set of numbers in the top right next to your AWS account name when using the AWS IoT Core website.
+* ``: Can be either `things` or `clients`.
+* ``: Depending on `` value, this is either IoT Thing name or MQTT client ID. Note that for a case
+ when `` is set to `clients`, `` will be the same as ``.
+* ``: MQTT client ID used for connection.
+
+Note that in a real application, you may want to avoid the use of wildcards in your ClientID or use them selectively.
+Please follow best practices when working with AWS on production applications using the SDK. Also, for the purposes of
+this sample, please make sure your policy allows a client ID of `test-*` to connect or use `--client_id `
+to send the client ID your policy supports.
+
+
+
+The triggered control plane operations in the walkthrough require AWS credentials with appropriate permissions to be
+sourceable. The following permissions must be granted:
+
+Sample Policy
+
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Action": "iot:ListCommands",
+ "Effect": "Allow",
+ "Resource": "arn:aws:iot:<region>:<account>:command/*"
+ },
+ {
+ "Action": "iot:CreateCommand",
+ "Effect": "Allow",
+ "Resource": "arn:aws:iot:<region>:<account>:command/<command_name>"
+ },
+ {
+ "Action": "iot:GetCommand",
+ "Effect": "Allow",
+ "Resource": "arn:aws:iot:<region>:<account>:command/<command_name>"
+ },
+ {
+ "Action": "iot:DeleteCommand",
+ "Effect": "Allow",
+ "Resource": "arn:aws:iot:<region>:<account>:command/<command_name>"
+ },
+ {
+ "Action": "iot:StartCommandExecution",
+ "Effect": "Allow",
+ "Resource": [
+ "arn:aws:iot:<region>:<account>:command/<command_name>",
+ "arn:aws:iot:<region>:<account>:<devices>/<device_id>"
+ ]
+ }
+ ]
+}
+
+
+Replace with the following with the data from your AWS account:
+* ``: The AWS IoT Core region where you created your AWS IoT Core thing you wish to use with this sample.
+ For example `us-east-1`.
+* ``: Your AWS IoT Core account ID. This is the set of numbers in the top right next to your AWS account name
+ when using the AWS IoT Core website.
+* ``: The unique identifier for your AWS IoT command, such as `LockDoor`. If you want to use more than
+ one command, you can use `*` (e.g. `test-*`) or specify multiple commands under the Resource section in the IAM policy.
+* ``: Must be either `thing` or `client` depending on whether your devices have been registered as AWS IoT things,
+ or are specified as MQTT clients.
+* ``: Depending on `` value, this is either IoT Thing name or MQTT client ID.
+
+
+
+## Running the Sample
+
+To run the sample, use the following Shell command:
+
+```shell
+mvn compile exec:java -pl samples/CommandsSandbox -Dexec.mainClass=commands.CommandsSandbox \
+ -Dexec.args="--endpoint