title: Why AWS IoT allows us to communicate with a "thing" without a certificate
body: <p>AWS IoT states that communication between a device and AWS IoT is protected through the use of X.509 certificates.</p>
  
  <p>Why is it that I can simply create a "thing" (via the Amazon CLI or SDK for example) and update its shadow etc. without attaching a certificate for security? </p>
  
  <p>How to configure AWS IoT to only allow things / devices to be available with certificates?</p>