AWS IoT Device Defender
IoT device fleet security
Audits the security configuration of your IoT device fleet, such as certificates and overly broad policies, and detects unusual device behavior using metrics, then alerts or isolates.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
Think of it asLike a security guard patrolling a building: checking door locks regularly and watching for anyone behaving unusually.
When to use it
✓ Use it when
A large IoT device fleet that needs to detect compromised or misconfigured devices.
✗ Avoid it when
Need to protect accounts/EC2 rather than IoT devices → GuardDuty / Security Hub.
Common uses
- Detect devices sending unusual data (botnet-infected)
- Audit expiring certificates and overly broad policies
- Alert via SNS on violations
What does it cost?
- Pricing model: Audit is billed per device each month; Detect is billed by the number of metric data points evaluated.
