How to Connect ESP32 to AWS IoT Core Using Custom Authorizer

Select Language:

Having trouble connecting your ESP32 device to an AWS IoT MQTT broker with a custom authorizer? Here’s a simple solution to get things working smoothly.

First, make sure your custom authorizer setup in AWS IoT is properly configured. Since you’ve disabled token signing and are verifying tokens directly in your Lambda, confirm that your Lambda is correctly receiving the event and returning the appropriate policy. From your logs, it looks like the Lambda is granting permission correctly, which is a good sign.

Next, check your MQTT connection details. You’re using the WebSocket Secure (WSS) endpoint on port 443, which is the right choice for many setups. However, with custom authorizers, you need to ensure you’re providing the correct token during connection. This usually means adding the token as a header or query parameter in the WebSocket URL, depending on how your authorizer is set up.

Here’s what to do:

Pass the Token in the Connection URL
Append your token as a query parameter when connecting via WSS. For example:

wss://your-endpoint.iot.region.amazonaws.com/mqtt?x-amz-custom-authorizer-name=YOUR_AUTHORIZER_NAME&x-amz-custom-authorizer-token=YOUR_TOKEN
Ensure Correct Endpoint and Path
Double-check that you’re using the right endpoint and path. For AWS IoT WebSocket connections, the URL often looks like:

wss://.iot..amazonaws.com/mqtt
Set Up Headers Properly (if needed)
Some SDKs allow passing custom headers. If your setup permits, include the token in headers instead of URL parameters.

ADVERTISEMENT
Device Certificate Alternative
Since your device can connect using device certificates, use this method if the custom authorizer proves too tricky. It’s straightforward and relies on established AWS IoT security practices.

To summarize, make sure the token is correctly passed during WebSocket connection—either as a URL parameter or a header—and confirm your Lambda’s response is accurate. If connecting still fails, double-check your policies and ensure the resource ARNs are correct.

Following these steps should help your ESP32 connect to your AWS IoT MQTT broker using your custom authorizer.