Amazon comes into the IoT game strong. You can build just about anything, but first you have to spend a lot of time sorting through pieces and searching for what you need.
There's no pre-built security group to allow inbound traffic from CloudFront, so I made an AWS Lambda function to periodically update our security group.