A company manufactures IoT sensors and embeds each sensor with an X.509 certificate, issued by the company's private certificate authority (CA), that contains a unique serial number. Certificates are installed on devices during manufacturing. After sensors are installed in stores, they must be able to send data to AWS, but they must not be able to send data before installation. Which provisioning approach meets these requirements?

The correct option leverages Just-in-Time Provisioning (JITP) with a pre-provisioning hook. Registering the private CA with AWS IoT Core and enabling allow-auto-registration means that when a device with a certificate signed by this CA first connects, AWS IoT Core automatically attempts to register it. The Lambda pre-provisioning hook allows for custom validation, such as checking the unique serial number in the X.509 certificate, ensuring the device is legitimate and ready for registration. This meets the requirement of provisioning only after installation. The first incorrect option, calling RegisterThing during manufacturing, provisions the device before installation, which is explicitly disallowed. The second incorrect option, using StartThingRegistrationTask, is for bulk registration, not for individual device auto-registration upon first connection, and Step Functions is not the standard mechanism for pre-provisioning hooks. The fourth incorrect option describes a manual provisioning process using claim certificates, which doesn't align with the auto-registration requirement based on the device's own certificate and the need for a pre-provisioning validation hook.