Connect an IoT device to AWS IoT Core using MQTT over mutual TLS with an X.509 certificate

Steps

1. Create a Thing in AWS IoT Core console or via CLI, then create and activate an X.509 certificate; attach a policy that allows iot:Connect, iot:Publish, and iot:Subscribe on the target topic ARNs
2. Download the device certificate, private key, and the Amazon Root CA bundle; store them securely on the device (never expose the private key in transit or logs)
3. Retrieve the device-specific data endpoint with: aws iot describe-endpoint --endpoint-type iot:Data-ATS; the returned hostname has the form <prefix>-ats.iot.<region>.amazonaws.com
4. Configure the MQTT client to connect to port 8883 with TLS 1.2+, supplying the CA bundle, device certificate, and private key; set ClientId to match the Thing name and send the SNI extension (required)
5. Publish a test message to a topic such as devices/<thing-name>/telemetry and verify receipt in the AWS IoT MQTT test client in the console
6. Attach the certificate to the Thing and verify the policy grants access; use CloudWatch Logs with IoT Core logging enabled to diagnose any AUTH or CONNECT errors