In my AWS Cognito User Pool I have a user with a custom attribute named “custom:Company”; I would like to use it in a IoT Core policy so that authenticated users are only allowed to subscribe to topics belonging to their own company, e.g. in pseudo-code: company/{custom:Company}/events.

My IoT Core authenticated user policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "arn:aws:iot:<OMITTED>:client/${cognito-identity.amazonaws.com:sub}"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Subscribe",
        "iot:Receive",
        "iot:Publish"
      ],
      "Resource": [
        "arn:aws:iot:<OMITTED>:topic/company/${cognito-identity.amazonaws.com:custom:Company}/events",
        "arn:aws:iot:<OMITTED>:topicfilter/company/${cognito-identity.amazonaws.com:custom:Company}/events"
      ]
    }
  ]
}

I tried to reference the custom user attribute in two ways with no success:

1. arn:aws:iot:<OMITTED>:topicfilter/company/${cognito-identity.amazonaws.com:custom:Company}/events
2. arn:aws:iot:<OMITTED>:topicfilter/company/${aws:PrincipalTag/Company}/events

If I specify a static fallback value, the policy works as expected, a clear sign that the dynamic variable is evaluated as not initialized; e.g.:

1. arn:aws:iot:<OMITTED>:topicfilter/company/${cognito-identity.amazonaws.com:custom:Company, ‘ACME’}/events

I would greatly appreciate any help.