"statusCode":403 error

```
pi@raspberrypi:~/다운로드/aws-iot-fleet-provisioning-master $ python3 main.py
______ __ __
/ ____/ / / ___ ___ / /_
/ /_ / / / _ \ / _ \ / __/
/ __/ / / / __/ / __/ / /_
/_/ /_/ \___/ \___/ \__/

____ _ _ _
/ __ \_________ _ __(_)____(_)___ ____ (_)___ ____ _
/ /_/ / ___/ __ \ | / / / ___/ / __ \/ __ \/ / __ \/ __ `/
/ ____/ / / /_/ / |/ / (__ ) / /_/ / / / / / / / / /_/ /
/_/ /_/ \____/|___/_/____/_/\____/_/ /_/_/_/ /_/\__, /
/____/

____________________________________________________________
/_____/_____/_____/_____/_____/_____/_____/_____/_____/_____/

##### CONNECTING WITH PROVISIONING CLAIM CERT #####
Connecting to ahfuh237qj0y0-ats.iot.ap-northeast-2.amazonaws.com with client ID 'test-0726-hiq'...
Connected!
Subscribing to topic '$aws/provisioning-templates/test-0726-fleet/provision/json/rejected'...
Subscribed with QoS.AT_LEAST_ONCE
Subscribing to topic '$aws/certificates/create/json/rejected'...
Subscribed with QoS.AT_LEAST_ONCE
Subscribing to topic '$aws/provisioning-templates/test-0726-fleet/provision/json/accepted'...
Subscribed with QoS.AT_LEAST_ONCE
Subscribing to topic '$aws/certificates/create/json/accepted'...
Subscribed with QoS.AT_LEAST_ONCE
Received message from topic '$aws/certificates/create/json/accepted': b'{"certificateId":"8311895ab97f4dbde42308f12ddb0394d923cd1d4f1922729f87c86afe0d0a27","certificatePem":"-----BEGIN CERTIFICATE-----\\nMIID~~\n-----END CERTIFICATE-----\\n","privateKey":"-----BEGIN RSA PRIVATE KEY-----\\nMIIE~~\\n-----END RSA PRIVATE KEY-----\\n","certificateOwnershipToken":"eyJ~~"}'
##### SUCCESS. SAVING KEYS TO DEVICE! #####
##### CREATING THING ACTIVATING CERT #####
Received message from topic '$aws/provisioning-templates/test-0726-fleet/provision/json/rejected': b'{"statusCode":403,"errorCode":"AccessDenied","errorMessage":"Access Denied"}'
Failed provisioning
b'{"statusCode":403,"errorCode":"AccessDenied","errorMessage":"Access Denied"}'
```
```
//provisioning template
{
"Parameters": {
"SerialNumber": {
"Type": "String"
},
"AWS::IoT::Certificate::Id": {
"Type": "String"
}
},
"Resources": {
"policy_Greengrass-jetson-nano-core-device-Policy": {
"Type": "AWS::IoT::Policy",
"Properties": {
"PolicyName": "Greengrass-jetson-nano-core-device-Policy"
}
},
"certificate": {
"Type": "AWS::IoT::Certificate",
"Properties": {
"CertificateId": {
"Ref": "AWS::IoT::Certificate::Id"
},
"Status": "Active"
}
},
"thing": {
"Type": "AWS::IoT::Thing",
"OverrideSettings": {
"AttributePayload": "MERGE",
"ThingGroups": "DO_NOTHING",
"ThingTypeName": "REPLACE"
},
"Properties": {
"AttributePayload": {},
"ThingGroups": [],
"ThingName": {
"Fn::Join": [
"",
[
"",
{
"Ref": "SerialNumber"
}
]
]
}
}
}
}
}
```
Greengrass-jetson-nano-core-device-Policy : Allow * *

When I run the code, things and certificates are generated, but the certificate says "pending activation".
And the code shows a 403 error.
I left everything in the policy open, but I couldn't find a solution.
How can I solve this problem?

Start by running main.py with the provisioning template and policy shown in the issue, then inspect the rejected provisioning response and the certificate status. Trace the certificate-creation and provisioning flow to determine why the request is denied; done means explaining the cause of the 403 and confirming that provisioning completes with the certificate activated.

Written by the indexing model from the issue text.