The Problem: Millions of Chatty Sensors
Imagine you have 1 million lightbulbs deployed across a city's smart grid. Each one needs to report its status, receive commands, and do so reliably — at scale, with minimal power, and without exposing credentials that could compromise the entire fleet.
- Scale: You can't have 1 million devices polling your web server (HTTP) every second. The connection overhead alone would crash a conventional server farm.
- Protocol: HTTP is too heavy for tiny battery-powered chips. Each HTTP request carries kilobytes of headers. A sensor with a 2KB RAM budget cannot afford that overhead.
- Security: You can't hardcode a database password into a lightbulb. If someone buys one at a garage sale and opens it up, they'd own your entire backend.
The Solution: IoT Core (MQTT)
AWS IoT Core is a fully managed cloud service that acts as a secure, scalable message broker for IoT devices. It handles authentication, routing, and fan-out so your application code never has to.
MQTT (Message Queuing Telemetry Transport) is the protocol at its heart. MQTT is a publish/subscribe protocol designed in the 1990s for oil pipeline monitoring — environments with unreliable networks and constrained hardware. It has three core properties that make it ideal for IoT:
- Lightweight: A minimal MQTT packet is just 2 bytes of fixed header. Compare that to hundreds of bytes for an HTTP request.
- Pub/Sub: Devices don't talk to each other directly. They publish messages to named topics, and any subscriber to that topic receives the message. This decouples producers from consumers completely.
- Quality of Service (QoS) levels: MQTT supports three delivery guarantees — QoS 0 (fire and forget), QoS 1 (at least once), and QoS 2 (exactly once). You choose the trade-off between reliability and overhead per message.
How it works in practice:
Lightbulb (Publisher) AWS IoT Core Mobile App (Subscriber)
| | |
|-- publish("home/kitchen/light", | |
| {"status":"on","watts":9}) | |
|------------------------------------>| |
| |-- route to all subscribers ------->|
| | |
The mobile app subscribes to home/+/light — the + is a single-level wildcard that matches any room. A # wildcard matches all remaining levels, so home/# would match every topic under home/.
Security (X.509 Certificates): Every device gets a unique X.509 certificate provisioned at manufacturing time. IoT Core uses mutual TLS (mTLS) — both the device and the server authenticate each other. Even if a hacker physically steals one lightbulb and extracts its private key, they can only impersonate that one device. You revoke its certificate in the IoT Core console and the other 999,999 devices are unaffected. This is fundamentally different from a shared API key, which would compromise everything.
IoT Core also includes:
- Rules Engine: Evaluate SQL-like expressions against incoming MQTT messages and route them to other AWS services — DynamoDB, Lambda, Kinesis, S3, SNS — without writing glue code.
- Device Registry: A central inventory of all your devices (called "Things") with metadata like firmware version, location, and device type.
- Device Gateway: The connection endpoint that scales automatically. AWS manages the infrastructure; you never provision MQTT brokers.
Interviewers often ask: "Why not just use HTTP for IoT?" The answer has three dimensions: (1) Protocol overhead — HTTP headers are kilobytes; MQTT fixed headers are 2 bytes. (2) Connection model — HTTP is request/response, requiring the device to poll; MQTT is persistent connection with server-push, so the device receives commands instantly without polling. (3) Power — maintaining a persistent MQTT connection is far cheaper than repeatedly establishing TCP+TLS handshakes for HTTP. Mention all three to show depth.