Provision a device fleet at scale with AWS IoT Fleet Provisioning by Claim using a shared claim certificate

Steps

1. Create a provisioning template in AWS IoT Core that defines the thing name pattern, policy, and optional pre/post provisioning hooks (Lambda ARNs).
2. Generate a single claim certificate and key pair; embed them in the device firmware at manufacture time and attach a restrictive policy allowing only the Fleet Provisioning MQTT API topics.
3. On first boot the device connects with the claim certificate, subscribes to $aws/certificates/create/json/accepted and /rejected, then publishes an empty payload to $aws/certificates/create/json to request a unique certificate.
4. Using the new certificate token returned in the accepted message, publish to $aws/provisioning-templates/TEMPLATE_NAME/provision/json with a parameters object matching the template variables.
5. Subscribe to the /accepted and /rejected response topics before publishing each request so no responses are missed on the same connection.
6. Store the returned certificate, private key, and thing name on the device's secure element or flash, then reconnect using the permanent certificate and discard the claim credentials.