A parks department streams fire-hydrant pressure readings into AWS…

Question

A parks department streams fire-hydrant pressure readings into AWS and must keep the ingestion path off the public internet. The architecture should use a private streaming or API endpoint secured with IAM—not an out-of-scope IoT specialty service. Which design best meets that requirement?

Accepted Answer

Ingest through Amazon Kinesis Data Streams or a private API Gateway endpoint using IAM auth and VPC private networking so telemetry never requires a public internet path — Picture the hydrant feed like a private city radio channel, not a bullhorn on Main Street. You want readings to land on a locked private pipe—Kinesis or a private API—with IAM checking badges, not IoT Core (out of scope) and not a wide-open public PUT bucket.

Answer

Publish every hydrant reading to a public S3 website endpoint with anonymous PUT enabled for simplicity

Answer

Expose an unauthenticated API Gateway HTTP API on 0.0.0.0/0 and rely only on obscurity of the URL

Answer

Choose AWS IoT Core as the only acceptable ingestion plane because the devices resemble IoT sensors

A parks department streams fire-hydrant pressure readings into AWS and must keep the ingestion path off the public internet. The architecture should use a private streaming or API endpoint secured with IAM—not an out-of-scope IoT specialty service. Which design best meets that requirement?

Short Explanation

Full Explanation