View a markdown version of this page

Using AWS IoT Core with interface VPC endpoints - AWS IoT Core
Creating VPC endpoints for AWS IoT Core control planeCreating VPC endpoints for AWS IoT Core data planeCreating VPC endpoints for AWS IoT Core credential providerCreating an Amazon VPC interface endpointConfigure a private hosted zoneControlling Access to AWS IoT Core over VPC endpointsLimitationsScaling VPC endpoints with AWS IoT CoreUsing custom domains with VPC endpointsAvailability of VPC endpoints for AWS IoT Core

Using AWS IoT Core with interface VPC endpoints

With AWS IoT Core, you can create IoT control plane endpoints and IoT data endpoints within your virtual private cloud (VPC) by using interface VPC endpoints. Interface VPC endpoints are powered by AWS PrivateLink, an AWS technology that you can use to access services running on AWS by using private IP addresses. For more information, see Amazon Virtual Private Cloud.

To connect devices in the field on remote networks, such as a corporate network to your Amazon VPC, refer to the options listed in the Network-to-Amazon VPC connectivity matrix.

Contents

Creating VPC endpoints for AWS IoT Core control plane

You can create a VPC endpoint for AWS IoT Core control plane API to connect your devices to AWS IoT services and other AWS services. To get started with VPC endpoints, create an interface VPC endpoint and select AWS IoT Core as the AWS service. If you are using the CLI, first call describe-vpc-endpoint-services to ensure that you are choosing an Availability Zone where AWS IoT Core is present in your particular AWS Region. For example, in us-east-1, this command would look like:

aws ec2 describe-vpc-endpoint-services --service-name com.amazonaws.us-east-1.iot.api

See the detailed instructions below to Create an Amazon VPC interface endpoint for AWS IoT Core control plane.

Creating VPC endpoints for AWS IoT Core data plane

You can create a VPC endpoint for AWS IoT Core data plane API to connect your devices to AWS IoT services and other AWS services. To get started with VPC endpoints, create an interface VPC endpoint and select AWS IoT Core as the AWS service. If you are using the CLI, first call describe-vpc-endpoint-services to ensure that you are choosing an Availability Zone where AWS IoT Core is present in your particular AWS Region. For example, in us-east-1, this command would look like:

aws ec2 describe-vpc-endpoint-services --service-name com.amazonaws.us-east-1.iot.data
Note

The VPC feature for automatically creating a DNS record is disabled. To connect to these endpoints, you must manually create a Private DNS record. For more information about Private VPC DNS records, see Private DNS for interface endpoints. For more information about AWS IoT Core VPC limitations, see Limitations .

To connect MQTT clients to the VPC endpoint interfaces:

  • Within your private hosted zone, create an alias record for each elastic network interface IP for the VPC endpoint. If you have multiple network interface IPs for multiple VPC endpoints, create weighted DNS records with equal weights across all the weighted records. These IP addresses are available from the DescribeNetworkInterfaces API call when filtered by the VPC endpoint ID in the description field.

See the detailed instructions below to Create an Amazon VPC interface endpoint and Configure private hosted zone for AWS IoT Core data plane.

Creating VPC endpoints for AWS IoT Core credential provider

You can create a VPC endpoint for AWS IoT Core credential provider to connect devices using client certificate-based authentication and get temporary AWS credentials in AWS Signature Version 4 format. To get started with VPC endpoints for AWS IoT Core credential provider, run the create-vpc-endpoint CLI command to create an interface VPC endpoint and select AWS IoT Core credential provider as the AWS service. To ensure that you are choosing an Availability Zone where AWS IoT Core is present in your particular AWS Region, your first run the describe-vpc-endpoint-services command. For example, in us-east-1, this command would look like:

aws ec2 describe-vpc-endpoint-services --service-name com.amazonaws.us-east-1.iot.credentials
Note

The VPC feature for automatically creating a DNS record is disabled. To connect to these endpoints, you must manually create a Private DNS record. For more information about Private VPC DNS records, see Private DNS for interface endpoints. For more information about AWS IoT Core VPC limitations, see Limitations .

To connect HTTP clients to the VPC endpoint interfaces:

  • Within your private hosted zone, create an alias record for each elastic network interface IP for the VPC endpoint. If you have multiple network interface IPs for multiple VPC endpoints, create weighted DNS records with equal weights across all the weighted records. These IP addresses are available from the DescribeNetworkInterfaces API call when filtered by the VPC endpoint ID in the description field.

See the detailed instructions below to Create an Amazon VPC interface endpoint and Configure private hosted zone for AWS IoT Core credential provider.

Creating an Amazon VPC interface endpoint

You can create an interface VPC endpoint to connect to AWS services powered by AWS PrivateLink. Use the following procedure to create an interface VPC endpoint that connects to AWS IoT Core data plane or AWS IoT Core credential provider. For more information, see Access an AWS service using an interface VPC endpoint.

Note

The processes to create an Amazon VPC interface endpoint for AWS IoT Core data plane and AWS IoT Core credential provider are similar, but you must make endpoint specific changes to make the connection work.

To create an interface VPC endpoint using VPC Endpoints console

  1. Navigate to the VPC Endpoints console, under Virtual private cloud on the left menu, choose Endpoints then Create Endpoint.

  2. In the Create endpoint page, specify the following information.

    • Choose AWS services for Service category.

    • For Service Name, search by entering the keyword iot. In the list of iot services displayed, choose the endpoint.

      If you create a VPC endpoint for AWS IoT Core control plane, choose the AWS IoT Core control plane API endpoint for your AWS Region. The endpoint will be of the format com.amazonaws.region.iot.api.

      If you create a VPC endpoint for AWS IoT Core data plane, choose the AWS IoT Core data plane API endpoint for your Region. The endpoint will be of the format com.amazonaws.region.iot.data.

      If you create a VPC endpoint for AWS IoT Core credential provider, choose the AWS IoT Core credential provider endpoint for your Region. The endpoint will be of the format com.amazonaws.region.iot.credentials.

      If you create a VPC endpoint for Federal Information Processing Standard (FIPS) regions, choose the FIPS API endpoint for your AWS Region. The endpoint will be of the format com.amazonaws.region.iot-fips.api. This is only for control plane.

      Note

      The service name for AWS IoT Core data plane in China Region will be of the format cn.com.amazonaws.region.iot.data. The service name for AWS IoT Core control plane in China Region will be of the format com.amazonaws.region.iot.api.

    • For VPC and Subnets, choose the VPC where you want to create the endpoint, and the Availability Zones (AZs) in which you want to create the endpoint network.

    • For Enable DNS name, make sure that Enable for this endpoint is not selected for AWS IoT Core data plane and AWS IoT Core credential provider. Neither AWS IoT Core data plane nor AWS IoT Core credential provider supports private DNS names yet.

      For AWS IoT Core control plane, Enable DNS name is selected by default. This ensures that any requests to the AWS IoT Core control plane public endpoints will route through the VPC endpoints instead. When this is enabled, you do not need to configure a privated hosted zone.

    • For Security group, choose the security groups you want to associate with the endpoint network interfaces.

    • Optionally, you can add or remove tags. Tags are name-value pairs that you use to associate with your endpoint.

  3. To create your VPC endpoint, choose Create endpoint.

After you create the AWS PrivateLink endpoint, in the Details tab of your endpoint, you'll see a list of DNS names. You can use one of these DNS names you created in this section to configure your private hosted zone. If you are using AWS IoT Core control plane, you do not need to configure a private hosted zone.

Configure a private hosted zone

Note

If you are using AWS IoT Core control plane and have Enable DNS name selected, you do not need to configure a private hosted zone. If you disable it, you must follow this procedure to configure a private hosted zone.

You can use one of these DNS names you created in the previous section to configure your private hosted zone.

For AWS IoT Core data plane

The DNS name must be your domain configuration name or your IoT:Data-ATS endpoint. An example DNS name can be: xxx-ats.data.iot.region.amazonaws.com.

For AWS IoT Core credential provider

The DNS name must be your iot:CredentialProvider endpoint. An example DNS name can be: xxxx.credentials.iot.region.amazonaws.com.

For AWS IoT Core control plane

The DNS name must be your AWS IoT Core control plane endpoint. An example DNS name for AWS IoT Core control plane is xxxx.api.iot.region.amazonaws.com.

Note

The processes to configure private hosted zone for AWS IoT Core data plane and AWS IoT Core credential provider are similar, but you must make endpoint specific changes to make the connection work.

Create a private hosted zone

To create a private hosted zone using Route 53 console

  1. Navigate to the Route 53 Hosted zones console and choose Create hosted zone.

  2. In the Create hosted zone page, specify the following information.

    • For Domain name, enter the endpoint address for your iot:Data-ATS or iot:CredentialProvider endpoint. The following AWS CLI command shows how to get the endpoint through a public network: aws iot describe-endpoint --endpoint-type iot:Data-ATS, or aws iot describe-endpoint --endpoint-type iot:CredentialProvider.

      Note

      If you're using custom domains, see Using custom domains with VPC endpoints. Custom domains are not supported for AWS IoT Core credential provider.

    • For Type, choose Private hosted zone.

    • Optionally, you can add or remove tags to associate with your hosted zone.

  3. To create your private hosted zone, choose Create hosted zone.

For more information, see Creating a private hosted zone.

Create a record

After you have created a private hosted zone, you can create a record that tells the DNS how you want traffic to be routed to that domain.

To create a record

  1. In the list of hosted zones displayed, choose the private hosted zone that you created earlier and choose Create record.

  2. Use the wizard method to create the record. If the console presents you the Quick create method, choose Switch to wizard.

  3. Choose Simple Routing for Routing policy and then choose Next.

  4. In the Configure records page, choose Define simple record.

  5. In the Define simple record page:

    • For Record name, enter iot:Data-ATS endpoint or iot:CredentialProvider endpoint. This must be the same as the private hosted zone name.

    • For Record type, if you want only IPv4 support, keep the value as A - Routes traffic to an IPv4 address and some AWS resources. If you want only IPv6 support, keep the value as AAAA - Routes traffic to an IPv6 address and some AWS resources. If you want dual-stack support (both IPv4 and IPv6), create two records (A and AAAA in the hosted zone with the same Record name and