AWS IoT Core
A fully managed service enabling bidirectional communication between IoT devices and the cloud via MQTT and HTTPS, supporting billions of device connections with certificate-based authentication
Overview
AWS IoT Core is a fully managed service that securely connects IoT devices such as sensors and embedded systems to the AWS cloud, enabling bidirectional messaging. In addition to the lightweight MQTT protocol, it supports HTTPS and MQTT over WebSocket, allowing protocol selection based on device communication requirements. Device Shadows for offline state management, a Rules Engine for message routing and transformation, and mutual authentication using X.509 certificates make it a foundational platform for building large-scale IoT systems.
Why MQTT Became the Standard for IoT Communication and Protocol Selection Tips
For battery-powered IoT devices with limited bandwidth, the request/response overhead of HTTP is a burden. MQTT is a publish/subscribe protocol running over TCP with a fixed header starting at just 2 bytes, making it lightweight. IoT Core supports both MQTT 3.1.1 and MQTT 5.0, with MQTT 5.0 enabling more flexible communication control including request/response patterns and message expiry. However, in environments where firewall restrictions block MQTT port 8883, MQTT over WebSocket (port 443) is effective. HTTPS is suitable for one-off data transmissions from devices and has the advantage of leveraging existing REST client libraries. In practice, one setup uses MQTT for always-on telemetry collection and HTTPS for low-frequency notifications like firmware version reporting. Azure IoT Hub also supports MQTT and HTTPS. In IoT Core, topic filters with wildcards support hierarchical topic designs.
Designing Offline Resilience with Device Shadows
In environments with unreliable network connectivity - factory production lines, agricultural sensors - devices cannot always communicate with the cloud. Device Shadows maintain each device's "desired" state and "reported" state as JSON documents on the cloud side. When an application wants to change a device's settings, it simply updates the Shadow's desired section. When the device comes back online, it reads the delta messages between desired and reported, synchronizes its state to match, and reports its current state. This design allows applications to issue control commands without being aware of device connectivity, while devices can reflect state at their own pace. Named Shadows allow a single device to have multiple shadows - for example, managing "temperature control" and "lighting control" as independent shadows makes per-function access control and version management easier.
Building Secure Data Pipelines with the Rules Engine and Certificate Authentication
IoT Core's Rules Engine filters and transforms MQTT messages received from devices using SQL-like syntax and routes them directly through rule actions to AWS services, HTTP endpoints, and other destinations. For example, you can declaratively define rules like "send only messages where temperature exceeds 50 degrees to Lambda, and accumulate all messages in S3." Direct writes to DynamoDB, streaming to Kinesis Data Streams, and triggering Step Functions workflows are all possible without writing code. For security, mutual TLS authentication with X.509 certificates is the foundation. Unique certificates are issued per device, and IoT Policies finely control which devices can publish/subscribe to which topics. With Just-in-Time Registration (JITR), certificates are automatically registered when a device connects for the first time (a newly registered certificate awaits activation). With fleet provisioning by claim, devices are manufactured with an embedded provisioning claim certificate, and AWS IoT issues a unique device certificate when the device connects for the first time (if the claim certificates are registered with AWS IoT).
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Lambda official page
- Amazon Kinesis official page
- Amazon DynamoDB official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.