A solution will run on AWS and receive connections from thousands of devices that must send and receive real-time MQTT messages. Each device must authenticate using its own unique X.509 certificate. Which architecture provides this capability with the least operational overhead?

AWS IoT Core is purpose-built for connecting billions of IoT devices and managing their interactions. It natively supports MQTT and X.509 certificate-based authentication for each device, directly addressing the core requirements with minimal operational overhead. Creating an AWS IoT thing for each device provides a managed identity. Using Amazon MQ is incorrect because it is a managed message broker service for open-source message brokers like ActiveMQ and RabbitMQ, not a direct MQTT broker for device connectivity at scale with X.509 authentication for individual devices. Deploying an MQTT broker on EC2 instances with an NLB and Lambda authorizer increases operational overhead significantly due to managing EC2, the broker software, and custom authentication logic. Similarly, configuring API Gateway with an NLB and an MQTT broker on EC2 adds unnecessary complexity and operational burden, as API Gateway is not designed for direct, persistent MQTT connections from IoT devices.