设置说明如下:
iot 有如下两个设备：testA,testB
A、B分别有两个不同的证书 ，两个证书分别有不同的策略。
现在需要通过testA设备，操作testB设备的shadow，testA策略如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:xxx:client/testA",
        "arn:aws:iot:us-east-2:xxx:client/testB"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish",
        "iot:Receive"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:xxx:topic/$aws/things/testA/shadow/*",
        "arn:aws:iot:us-east-2:xxx:topic/$aws/things/testB/shadow/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Subscribe"
      ],
      "Resource": [
        "arn:aws:iot:us-east-2:xxx:topicfilter/$aws/things/testA/shadow/*",
        "arn:aws:iot:us-east-2:xxx:topicfilter/$aws/things/testB/shadow/*"
      ]
    }
  ]
}

注意：
iot:Publish、iot:Receive、iot:Subscribe以及topic / topicfilter的设置，与aws文档说明稍有不同。按aws文档会有问题