Provisioning template grants iot:* on resource * to every provisioned device

Every provisioned printer gets a policy allowing Connect/Subscribe/Publish/Receive on ALL resources. A compromised printer can subscribe to all other printers' job topics (intercept print jobs containing card designs with cardholder names), publish fake telemetry for other devices, or impersonate any device.

Fix: Use IoT policy variables:

{
"Statement": [
{ "Effect": "Allow", "Action": "iot:Connect", "Resource": "arn:aws:iot:REGION:ACCOUNT:client/Printer_${iot:Connection.Thing.ThingName}" },
{ "Effect": "Allow", "Action": "iot:Publish", "Resource": ["arn:aws:iot:REGION:ACCOUNT:topic/printer_status/${iot:Connection.Thing.ThingName}", "arn:aws:iot:REGION:ACCOUNT:topic/job_status/${iot:Connection.Thing.ThingName}/*"] },
{ "Effect": "Allow", "Action": "iot:Subscribe", "Resource": "arn:aws:iot:REGION:ACCOUNT:topicfilter/print_jobs/${iot:Connection.Thing.ThingName}" },
{ "Effect": "Allow", "Action": "iot:Receive", "Resource": "arn:aws:iot:REGION:ACCOUNT:topic/print_jobs/${iot:Connection.Thing.ThingName}" }
]
}