Implement X.509 Just-in-Time Provisioning (JITP) in AWS IoT Core with a CA-signed device certificate

Steps

1. Register your CA certificate in AWS IoT Core with the 'aws iot register-ca-certificate' command; enable automatic registration and choose JITP mode.
2. Attach a provisioning template to the CA certificate (as a JSON string in --registration-config) that specifies the thing name pattern, policy ARN, and an optional IAM role for the provisioning service to assume.
3. Pre-install each device with a unique X.509 certificate signed by the registered CA and the CA's root certificate chain.
4. On first MQTT connect, AWS IoT Core detects the unregistered device certificate, triggers JITP, creates the thing and registers the certificate using the attached template — no Lambda function required.
5. The initial connection is rejected (the device must reconnect) after provisioning completes; design device firmware to automatically reconnect after a short delay.
6. For custom business logic (allow-list checks, database registration), use JITR instead: listen for registration lifecycle events on $aws/events/certificates/registered/CA_CERT_ID and route them to a Lambda via an IoT Rule.