Deliver IoT SIM traffic privately into AWS

Updated 26 October 2026

To deliver IoT SIM traffic privately into AWS, your SIMs use a private APN and their traffic reaches your VPC over AWS Direct Connect, landing on a Transit Gateway or a virtual private gateway as ordinary private IP traffic. Devices have no public IP address and are unreachable from the internet. An AWS Site-to-Site VPN is also possible: faster to start, encrypted, but routed over the internet.

Status: Coming soon (checked 26 October 2026) · Notify me when available

Key points

• Two options. AWS Direct Connect (no internet path) or AWS Site-to-Site VPN (IPsec over the internet).
• Hosted connection. For Direct Connect, a hosted connection appears in your AWS console; AWS lists hosted speeds from 50 Mbit/s to 25 Gbit/s.
• Transit Gateway or not. AWS allows a transit virtual interface on any hosted connection of any speed, so several VPCs and accounts can share one delivery.
• Your addressing. You choose the private IP range of your SIMs so it does not overlap your VPCs.

Reference architecture

IoT device ── mobile network ── private APN ── AWS Direct Connect (hosted connection)
                                                     │  transit virtual interface (BGP)
                                                     ▼
                                          Direct Connect gateway
                                                     │
                                                     ▼
                                     Transit Gateway ── VPC A (backend)
                                                     └── VPC B (data lake)

For a single VPC, replace the Direct Connect gateway and Transit Gateway with a private virtual interface on the VPC’s virtual private gateway.

Steps

1. Tell us your AWS account ID, the AWS Region of your VPCs, and the private IP range for your SIMs (or let us propose one that does not overlap your VPC CIDRs).
2. Accept the hosted connection that appears in the Direct Connect console of your account.
3. Create the virtual interface: a transit virtual interface to a Direct Connect gateway associated with your Transit Gateway, or a private virtual interface to your virtual private gateway.
4. Exchange routes over BGP. We advertise your SIM range; your side advertises the VPC ranges the devices may reach.
5. Open the security groups and network ACLs of your servers to the SIM range only.
6. Test from a device: a request to a private IP in your VPC must answer; a request to the internet must not, unless you allowed it.

Cost on the AWS side

AWS bills Direct Connect by port-hour, even when no data flows, and by data transferred out of AWS. Data transferred into AWS over Direct Connect is charged $0.00 per GB, and device-to-cloud traffic is inbound. On hosted connections, AWS lists port-hour rates from $0.03 (50 Mbit/s) to $6.20 (25 Gbit/s); see AWS Direct Connect pricing, checked on 26 October 2026. Our own price for private delivery is on the pricing page.

Learn more

• How private delivery works
• Private APN vs public APN vs VPN
• Let an AI agent manage your SIMs (MCP)