AWS IoT Core over private delivery: MQTT without the internet

Updated 27 October 2026

Cellular devices reach AWS IoT Core privately when their SIM traffic lands in your VPC over private delivery and the VPC has an interface VPC endpoint for the AWS IoT Core data plane. MQTT then flows between private IP addresses only: the device’s address on the private APN and the endpoint’s network interfaces in your subnets. AWS documents the endpoint, its DNS setup and its limits in Using AWS IoT Core with interface VPC endpoints.

Status: Coming soon (checked 26 October 2026) · Notify me when available

Architecture

Device (MQTT, X.509) ── private APN ── AWS Direct Connect ── Transit Gateway or VGW
                                                                   │
                                                                   ▼
                                         VPC: interface endpoint com.amazonaws.<region>.iot.data
                                              Route 53 private hosted zone (your IoT endpoint name)
                                              Route 53 Resolver inbound endpoint (device DNS)

Steps

1. Deliver SIM traffic into the VPC that will hold the endpoint: see private delivery into AWS. Pick a SIM address range that does not overlap your VPC ranges.
2. Create the interface endpoint for the service com.amazonaws.<region>.iot.data in the subnets of your choice. AWS suggests checking first that the service exists in your Availability Zones with aws ec2 describe-vpc-endpoint-services --service-name com.amazonaws.<region>.iot.data.
3. Create the DNS records yourself. AWS disables automatic private DNS for this endpoint. In a Route 53 private hosted zone attached to the VPC, create a record for your account’s IoT data endpoint name pointing to the endpoint’s network interface addresses (weighted records with equal weights if there are several).
4. Let devices resolve that zone. Devices are outside the VPC, so their DNS queries must reach Route 53: create a Route 53 Resolver inbound endpoint and give its addresses to the private APN as DNS servers, or forward your IoT endpoint name to it.
5. Allow the traffic in the endpoint’s security group: TCP 8883 (or 443) from the SIM address range.
6. Connect a device with its X.509 certificate to your usual IoT endpoint name. If the name resolves to a private address, the session is private.

Limits to know (from the AWS documentation)

Ports

From AWS IoT Core protocols and ports: MQTT with an X.509 client certificate uses 8883, or 443 with the ALPN protocol name x-amzn-mqtt-ca; HTTPS publishing with a certificate uses 8443. Port 443 with ALPN exists for networks that block 8883; on a private APN you set the rules yourself, so 8883 is the simplest choice.

Why use it

• No public exposure: these devices never use the public IoT endpoint, and they have no public IP address.
• Same certificates and policies: devices keep their AWS IoT identity; only the network path changes.
• Cellular data stays off the internet from the SIM to the broker, including when devices roam abroad.

The SIMs: IoT SIM cards. Other services: all integrations.