AWS IoT Core is a managed Amazon Web Services cloud service that connects IoT devices to the cloud and lets them exchange data securely at a scale of millions of connections. For IoT device manufacturers it is the foundation of the backend: message broker, authentication layer and rules engine rolled into one. In this guide we explain how AWS IoT Core works and when to choose it over the alternatives.
In short: AWS IoT Core connects devices over the MQTT protocol with mutual authentication based on X.509 certificates, routes telemetry to AWS services through the Rules Engine, keeps device state in Device Shadow and lets you roll out thousands of units thanks to Fleet Provisioning - all billed according to actual usage.
What is AWS IoT Core?
AWS IoT Core is a managed message broker and connectivity platform for IoT devices within the Amazon Web Services ecosystem. At the heart of the service sits the Device Gateway - a publish-subscribe broker that handles the MQTT protocol (versions 3.1.1 and 5.0), MQTT over WebSocket and HTTPS, as well as LoRaWAN networks natively.
In practice, AWS IoT Core takes three hard problems off the engineering team: scaling the broker to millions of concurrent connections, authenticating every device securely, and integrating the telemetry stream with the rest of the cloud. The manufacturer can focus on firmware and hardware instead of maintaining communication infrastructure.
How does device authentication work in AWS IoT Core?
Authentication in AWS IoT Core is based by default on mutual TLS with X.509 certificates - every device holds a unique certificate and private key, and the server verifies its identity on every connection. This is a zero-trust model: without a valid certificate the connection is never established at all.
Besides X.509 certificates, the service supports AWS SigV4 authentication, Amazon Cognito and custom authorizers built on AWS Lambda. Permissions are defined by AWS IoT policies in JSON format, which spell out the allowed actions (iot:Connect, iot:Publish, iot:Subscribe) and MQTT topics. Thanks to policy variables such as iot:Connection.Thing.ThingName, a single policy can safely serve an entire fleet, because each device publishes only to its own topics.
Device Shadow and Rules Engine: how does data flow?
Device Shadow is a persistent JSON document in the cloud that reflects the state of a device even while it is offline. It contains the desired section (target state), reported (state reported by the device) and delta (the difference), so an application can change a device configuration and the device will synchronise it once it is back online.
The Rules Engine is a rules engine with SQL-like syntax that filters and routes MQTT messages to other services without any intermediary server. A single rule can write telemetry into a time-series database, invoke a Lambda function and send an alert. Typical rule targets include:
- AWS Lambda - business logic and on-the-fly transformations;
- Amazon DynamoDB / Timestream - durable telemetry storage;
- Amazon S3 - raw data archiving and the data lake;
- Amazon Kinesis, SNS, SQS - streaming and notifications.
Fleet Provisioning: how do you roll out thousands of devices?
Fleet Provisioning is a mechanism for mass, hands-off device registration in AWS IoT Core based on provisioning templates. Instead of manually flashing a certificate onto every single unit on the production line, the device fetches and activates its own identity on first boot.
Two approaches are available: provisioning by claim certificate shared across a production batch, and Just-in-Time Provisioning (JITP) based on a trusted certificate authority. This is the natural extension of a zero-touch provisioning strategy. Once deployed, you manage the fleet through AWS IoT Device Management, including remote OTA firmware updates delivered as Jobs.
AWS IoT Greengrass: processing at the edge
AWS IoT Greengrass is a runtime that moves AWS IoT logic out to the edge of the network - directly onto a gateway or a device. It lets you run functions, containers and machine learning models locally, buffer data and keep operating offline when cloud connectivity is unreliable.
Greengrass is the right choice when low latency, reduced data transfer costs or data privacy matter. It is a practical application of edge computing: a machine learning model classifies anomalies locally, and only the significant events reach the cloud instead of the raw stream from every sensor.
AWS IoT Core vs Azure IoT Hub: which should you choose?
AWS IoT Core and Azure IoT Hub offer a comparable feature set: an MQTT broker, X.509 authentication, digital twins of device state and bulk provisioning. The difference lies in the ecosystem in which you build the rest of the system - if your backend, analytics and applications already run in a given cloud, pick the same platform to simplify integration and billing.
AWS stands out with a Rules Engine offering a rich set of native targets and with a mature Greengrass at the edge. Microsoft, in turn, integrates Azure IoT Hub tightly with the Device Provisioning Service and the wider Azure data ecosystem. At FSS we deliver both variants and match the platform to the requirements of the project, not the other way round.
How much does AWS IoT Core cost?
AWS IoT Core is billed according to actual usage, with no upfront fees and no minimums. The cost consists of several independent dimensions, so you pay only for what your fleet really consumes:
- Connectivity - in the region of USD 0.08 per million connection minutes;
- Messages - roughly USD 1 per million, counted in 5 KB blocks;
- Device Shadow and registry - per million operations on state documents;
- Rules Engine - per million rules triggered and actions executed.
Prices vary between regions, so it is worth estimating your message volume and using the AWS calculator before deployment. For a typical industrial fleet the dominant cost is usually messages rather than connectivity itself.
Frequently asked questions (FAQ)
How does AWS IoT Core differ from an ordinary MQTT broker?
AWS IoT Core is a managed MQTT broker extended with cloud services: X.509 authentication, rules that route data to more than 20 AWS services, Device Shadow and bulk fleet provisioning. An ordinary broker such as Mosquitto only handles publish-subscribe - with no integrations, no per-device authorisation and no scaling to millions of connections.
Does AWS IoT Core support offline devices?
Yes. Device Shadow stores the last known device state in the cloud, so applications can read and set parameters while the device is offline. Once it reconnects, the device receives the state difference (delta) and synchronises its configuration. For fully local operation, AWS IoT Greengrass is the answer.
How much does it cost to run AWS IoT Core?
AWS IoT Core is billed by usage with no upfront fees: separately for connections (in the region of USD 0.08 per million minutes), messages (roughly USD 1 per million, in 5 KB blocks), Device Shadow operations and rules. For a fleet of 10,000 devices sending telemetry every minute this typically means tens to a few hundred USD per month, depending on region and volume.
Summary: key takeaways
AWS IoT Core is a complete foundation for an IoT product: a secure MQTT broker, X.509 authentication, Device Shadow for offline operation, a Rules Engine for cloud integration, plus Fleet Provisioning and Greengrass for scaling the fleet. A well-designed architecture on AWS IoT Core shortens the path from prototype to a rollout of thousands of devices.
FSS is a full-stack team - we design hardware and PCBs, write firmware and build cloud backends on AWS and Azure. If you are planning a product based on AWS IoT Core, take a look at our cloud infrastructure services or see how we deliver complete cloud-connected devices - from schematic to production.