+1 on the "Typical AWS issues" regarding policies. Even Amazon's own examples tend to confuse the issue more and it is typically after much trial and error do you attain the sweet spot for sensible policies that prioritize security. My only other gripe is MQTT retain is not supported, although as mentioned Device Shadows do provide this type of feature.