The only way I figured is Lambda to handle user session identityid
iot_client.attach_principal_policy(policyName=POLICY_NAME, principal=identity_id)