Skip to main content

Angle 3 — `mobile-and-device-stack`

Generated at build time from research/aws-demo-catalog/sources/mobile-and-device-stack.md in the repo — edit the source, not this page.

Date: 2026-09-04. Scope: the AWS-recommended path for iOS + Android + responsive web, scoped to catalog items U1 (patient portal + companion app) and U2 (remote patient monitoring, phone-paired devices). Cross-references to angle 1 (repos) and angle 2 (HIPAA eligibility) are marked as such and not duplicated here.

Summary​

Amplify Gen 2 is the only supported Amplify path for new work: Gen 1 backends entered maintenance on 2026-05-01 and reach end of life on 2027-05-01. All four client libraries are actively released (Swift 2.60.2 on 2026-09-01, Android 2.41.1 on 2026-09-02, Flutter 2.15.0 on 2026-08-19, JS packages on 2026-09-01), but parity is uneven: Swift and Android have full Cognito passwordless/passkey support and AppSync Events clients; Flutter has neither (both are open feature requests; a WebAuthn PR opened 2026-04-08 is still an unmerged draft). The classic AWS Mobile SDKs for iOS/Android reached end of support on 2026-08-01 and must not be used, even though the IoT Core docs page still lists them as the "Mobile SDKs". Amazon Pinpoint's end of support is confirmed as 2026-10-30 (no new customers since 2025-05-20); AWS's named successors are AWS End User Messaging for push/SMS/voice/OTP, Amazon SES for email, Amazon Connect (outbound campaigns / Customer Profiles) for engagement, and Kinesis for event analytics; there is no successor for Pinpoint In-App Messaging. SNS mobile push remains documented and undeprecated and is a valid transactional-push choice, but it is not the AWS-named Pinpoint successor. Cognito's mobile story is now Managed Login (2024-11), passkeys/OTP passwordless on the Essentials plan (default for new pools), and refresh-token rotation (2025-04); passkeys satisfy MFA only with user verification required, and OTP-first-factor sign-in is incompatible with required MFA — a design constraint for a HIPAA app. Device Farm is active (last What's New 2025-11-21) but us-west-2 only; Amazon Location Service is very active in 2026. For phone-paired health devices there is no AWS guidance at all for Apple HealthKit or Android Health Connect; both are on-device stores that must be read by the app and forwarded, and Apple's App Store rule 5.1.3 forbids storing personal health information in iCloud. The supported phone-to-cloud paths are (a) MQTT to IoT Core using a Cognito identity + attached IoT policy with the now-GA AWS IoT Device SDK for Swift (GA 2026-06-01) or the IoT Device SDK for Java v2 on Android, or (b) a Cognito-JWT REST/GraphQL call through Amplify's REST (API Gateway) or Data (AppSync) categories to the FastAPI backend. The only AWS sample of a phone acting as a BLE-to-IoT-Core gateway is aws-samples/aws-amplify-cdk-iot-ble-swift-app (MIT-0, security-refreshed 2026-06-09 but still on an older Amplify iOS dependency) plus an architecture-only Solutions Library Guidance for Android BLE gateways. No first-party Amplify mobile healthcare sample exists; the Amplify healthcare samples that do exist (HealthScribe demo, HealthImaging viewer) are web-only.

Status legend used below: REC = recommended by AWS docs; SUP = supported but not recommended (or not singled out) by AWS; NONE = no AWS guidance found.

A. Amplify Gen 2 status and client-library coverage (U1 Tier 1, U2 Tier 1)​

#FindingSource (dated)TierConfidenceStatus
A1Amplify Gen 2 (code-first TypeScript backend, CDK underneath) has been GA since 2024-05-06 and is the path AWS recommends for new projects.AWS What's New, "AWS Amplify Gen 2 is now generally available", 2024-05-06, https://aws.amazon.com/about-aws/whats-new/2024/05/aws-amplify-gen-2-available/ ; Amplify FAQ (retrieved 2026-09-04) https://docs.amplify.aws/react/how-amplify-works/faq/PrimaryHighREC
A2Amplify Gen 1 is in maintenance mode: from 2026-05-01 Gen 1 backends receive only critical bug fixes and security patches; end of life 2027-05-01. Migration guide and tooling exist.GitHub aws-amplify/amplify-cli issue #14881 "Amplify Gen 1 is in Maintenance Mode", posted 2026-05-14, https://github.com/aws-amplify/amplify-cli/issues/14881 ; Amplify FAQ (retrieved 2026-09-04)PrimaryHigh—
A3Amplify Swift is actively released: 2.60.2 on 2026-09-01 (2.60.1 2026-08-04, 2.60.0 2026-08-03, 2.59.0 2026-07-30). Requires iOS 15+, Swift 6.0, Xcode 26. Categories: Auth (Cognito), Storage (S3), Analytics (Pinpoint), Geo (Location), Data/API GraphQL (AppSync), DataStore, REST API (API Gateway), Predictions, Push Notifications (Pinpoint). No PubSub category (unlike the old Amplify iOS v1). README carries a Pinpoint retirement warning covering Analytics and Push.GitHub aws-amplify/amplify-swift releases + README, retrieved 2026-09-04, https://github.com/aws-amplify/amplify-swift/releasesPrimaryHighREC (native iOS)
A4Amplify Android is actively released: 2.41.1 on 2026-09-02 (2.41.0 2026-08-27, 2.40.0 2026-08-18, 2.39.0 2026-07-30). Latest fix notes cover User-Pool-only auth sessions and AppSync subscription reconnection.GitHub aws-amplify/amplify-android releases.atom, retrieved 2026-09-04, https://github.com/aws-amplify/amplify-android/releasesPrimaryHighREC (native Android)
A5Amplify Flutter is actively released: 2.15.0 on 2026-08-19 ("Add iOS 27 support"); 2.14.0 2026-07-31; 2.13.0 2026-07-23. Requires Android API 24+, Gradle 8+, Kotlin 1.9+, Java 17+.GitHub aws-amplify/amplify-flutter releases.atom, retrieved 2026-09-04, https://github.com/aws-amplify/amplify-flutter/releases ; Flutter platform setup https://docs.amplify.aws/flutter/start/platform-setup/PrimaryHighSUP (see A8)
A6Amplify JS (used by React web and React Native) is actively released: package releases on 2026-09-01 (@aws-amplify/geo@2.3.19, @aws-amplify/notifications@1.6.23, etc.).GitHub aws-amplify/amplify-js releases.atom, retrieved 2026-09-04, https://github.com/aws-amplify/amplify-js/releasesPrimaryHighREC (web)
A7React Native on Gen 2: supported via @aws-amplify/react-native; Expo Go is not supported (Amplify needs native modules), plain Expo is; React Native for Web is "not officially supported yet". Min iOS 13 for RN <= 0.72.Amplify FAQ and RN quickstart, retrieved 2026-09-04, https://docs.amplify.aws/react/how-amplify-works/faq/ , https://docs.amplify.aws/react-native/start/quickstart/PrimaryHighSUP
A8Flutter parity gaps (both open as of 2026-09-04): (i) no AppSync Events client — issue #6106 open since 2025-04-04, no maintainer response visible; (ii) no Cognito passwordless/passkey support — issue #6094 open since 2025-03-27; draft PR #6851 "Add WebAuthn/passkey support across all platforms" opened 2026-04-08, not merged. Workaround cited: custom auth flows.GitHub aws-amplify/amplify-flutter issues #6106, #6094, PR #6851, retrieved 2026-09-04Primary (repo state)High—
A9Gen 1 → Gen 2 feature-parity matrices (Swift, Android, Flutter) agree on: Analytics, Push Notifications, Predictions, Interactions require custom CDK or are unsupported in Gen 2; DataStore/conflict detection removed; manyToMany and @searchable unsupported; Hosting is Git-based only (amplify push/publish gone; use npx ampx pipeline-deploy); Geo supported via CDK; new: TypeScript functions, MySQL/PostgreSQL data sources, first-class OIDC/SAML. Android matrix additionally lists "REST API frontend category" as not supported while listing REST API backend as supported — ambiguous, verify before relying on Amplify REST from Android.docs.amplify.aws feature matrices, retrieved 2026-09-04: https://docs.amplify.aws/swift/start/migrate-to-gen2/feature-matrix/ , https://docs.amplify.aws/android/start/migrate-to-gen2/feature-matrix/ , https://docs.amplify.aws/flutter/start/migrate-to-gen2/feature-matrix/PrimaryHigh (Medium on the Android REST ambiguity)—
A10The classic AWS Mobile SDKs (aws-sdk-ios, aws-sdk-android) are deprecated and reached End of Support on 2026-08-01 ("no further updates of any kind"); AWS directs users to Amplify Swift / Amplify Android. Note: the IoT Core "Device SDKs, Mobile SDKs" docs page still lists these as the Mobile SDKs for IoT on mobile — that page is stale.READMEs of https://github.com/aws-amplify/aws-sdk-ios and https://github.com/aws-amplify/aws-sdk-android (retrieved 2026-09-04); IoT docs https://docs.aws.amazon.com/iot/latest/developerguide/iot-sdks.html (retrieved 2026-09-04)PrimaryHighDo not use
A11Amplify Hosting: WAF integration GA 2025-03-26 ($15/app/month plus WAF charges; all Hosting regions); customizable build instances (Standard/Large/XLarge) announced 2025-05. No Amplify Hosting What's New post found in 2026 (search only; the Hosting doc-history page did not render). Not "quiet/retired" — treat as stable.AWS What's New 2025-03-26 https://aws.amazon.com/about-aws/whats-new/2025/03/aws-amplify-hosting-web-application-firewall-protection ; What's New 2025-05 https://aws.amazon.com/about-aws/whats-new/2025/05/aws-amplify-hosting-customizable-build-instancesPrimary for 2025 facts; absence-of-2026-news is search-onlyMediumSUP (catalog already marks Hosting optional; CloudFront/S3 is the spine)
A12Amplify healthcare samples: no first-party Amplify native-mobile healthcare sample found. Web-only Amplify healthcare samples exist: aws-samples/aws-healthscribe-demo (Amplify + Cloudscape + Cognito + S3) and aws-samples/aws-healthimaging-samples (Amplify front end for HealthImaging). Generic mobile samples: aws-amplify/amplify-android-samples (Java + Kotlin), aws-samples/aws-amplify-android-simple-app, aws-samples/aws-amplify-flutter-example. Dates/licences: defer to angle 1.GitHub search results, retrieved 2026-09-04Primary (repo existence)Medium (absence claim)NONE for mobile healthcare

Native vs cross-platform (brief open question 6): Swift and Android/Kotlin are the only two Amplify clients with full 2026 feature coverage (passkeys, Events API, USER_AUTH choice flow). React Native follows JS closely (passwordless documented for RN; no RN-specific limitation stated — see C6). Flutter lags on both passkeys and Events. If U1 must demonstrate passkeys and real-time on both phones with one codebase, React Native is the safer cross-platform choice today; Flutter is not.

B. API layer for mobile: AppSync vs API Gateway (U1 Tier 1, U2 Tier 1)​

#FindingSource (dated)TierConfidenceStatus
B1Amplify Gen 2's Data category is "powered by AWS AppSync and connected to an Amazon DynamoDB database" and auto-creates "real-time APIs to subscribe for create, update, and delete events". This is the Amplify default data path for web and all mobile clients.https://docs.amplify.aws/react/build-a-backend/data/set-up-data/ (retrieved 2026-09-04)PrimaryHighREC (within Amplify)
B2AppSync Events (serverless WebSocket pub/sub, namespaces/channels, wildcards) launched 2024-10; publishing over the WebSocket added 2025-03-13. AWS positions it for "real-time web and mobile experiences at any scale".AWS What's New 2024-10 https://aws.amazon.com/about-aws/whats-new/2024/10/aws-appsync-websocket-apis-web-mobile-experiences ; What's New 2025-03-13 https://aws.amazon.com/about-aws/whats-new/2025/03/appsync-events-publishing-websocket-real-time-pub-subPrimaryHighREC for real-time fan-out
B3AWS Prescriptive Guidance's stated rule: use AppSync Events when you have many channels grouped in namespaces with wildcard pub/sub and communication is mainly system-to-system; use API Gateway WebSocket when clients need persistent connections to AWS service integrations, you want to manage connection IDs yourself, or you need API Gateway features (stages, proxy integrations, custom subprotocols).https://docs.aws.amazon.com/prescriptive-guidance/latest/modernization-integrating-microservices/appsync-api-gateway.html (undated page, retrieved 2026-09-04)PrimaryHighREC (decision rule)
B4Events API mobile clients: Swift ("AWS AppSync Events Library for Swift", API key / Cognito user pool / IAM authorizers, REST + WebSocket clients, publish up to 5 events, wildcard subscribe) and Android (com.amazonaws:aws-sdk-appsync-events + aws-sdk-appsync-amplify) are documented; Flutter is not (A8).https://docs.amplify.aws/swift/build-a-backend/data/connect-event-api/ , https://docs.amplify.aws/android/build-a-backend/data/connect-event-api/ (retrieved 2026-09-04)PrimaryHigh—
B5REST on API Gateway is supported in Gen 2 ("Set up Amplify REST API" with AWS_IAM or Cognito user-pool auth; HTTP API variant; "use existing resources" for a pre-built API Gateway). This is the documented way to front a non-Amplify backend such as FastAPI on Fargate.https://docs.amplify.aws/react/build-a-backend/add-aws-services/rest-api/ (retrieved 2026-09-04); Swift/Flutter matrices list REST API as supported (A9)PrimaryHighSUP
B6No AWS document was found that recommends AppSync over API Gateway (or vice versa) for a "mobile + web app in front of a container backend". The documented split is: Amplify Data (AppSync GraphQL) when Amplify owns the data model; API Gateway REST/HTTP when proxying an existing backend; AppSync Events for push-style real-time. For the catalog spine (FastAPI on Fargate) the natural reading is API Gateway HTTP API → FastAPI for commands/queries plus AppSync Events for real-time (U2 vitals, U1 messaging), with AppSync GraphQL optional. HIPAA eligibility of AppSync, API Gateway and AppSync Events: cross-check angle 2.Synthesis of B1–B5—MediumNONE (explicit)

C. Cognito mobile auth patterns (U1 Tier 1)​

#FindingSource (dated)TierConfidenceStatus
C1Managed Login (branded, responsive hosted sign-in/sign-up with MFA and password reset) launched 2024-11-22; the classic hosted UI remains on all plans, managed login needs Essentials or Plus.AWS What's New 2024-11 https://aws.amazon.com/about-aws/whats-new/2024/11/amazon-cognito-managed-login ; feature plans doc https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html (retrieved 2026-09-04)PrimaryHighREC
C2Passwordless (passkeys/WebAuthn, email OTP, SMS OTP) launched 2024-11-22, Essentials tier, all regions except GovCloud (GovCloud added 2025-03). Amplify support for JS, Swift and Android announced 2024-11-27 (Flutter not included; still open — A8).https://aws.amazon.com/about-aws/whats-new/2024/11/amazon-cognito-passwordless-authentication-low-friction-secure-logins ; https://aws.amazon.com/about-aws/whats-new/2024/11/aws-amplify-passwordless-authentication-amazon-cognitoPrimaryHighREC
C3Feature plans: Lite / Essentials / Plus; Essentials is the default for new pools. Passkeys, OTP passwordless, email MFA, managed-login visual editor, access-token customization need Essentials+. Compromised-credential and risk-based sign-in protection (former "advanced security") need Plus.https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html (retrieved 2026-09-04)PrimaryHigh—
C4Passkey mechanics relevant to mobile: only in the choice-based USER_AUTH flow (AllowedFirstAuthFactors incl. WEB_AUTHN, which must be paired with another factor); RP ID defaults to the pool's custom or prefix domain and can be any non-PSL domain; "Passkey is only functional in mobile applications when Amazon Cognito can locate a .well-known association file with your RP ID as the domain"; up to 20 passkeys per user; registration only after a first sign-in; ES256/RS256; no attestation enforcement.https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow-methods.html (retrieved 2026-09-04)PrimaryHighREC
C5MFA interaction (design constraint for a HIPAA app): "One-time password (OTP) authentication flows aren't compatible with required MFA"; a passkey with user verification counts as MFA only when FactorConfiguration = MULTI_FACTOR_WITH_USER_VERIFICATION; "Passkeys cannot be used as a second factor to password sign-in". Practical U1 pattern: password/SRP + TOTP/SMS/email MFA, or passkey with user verification required as the MFA-satisfying first factor; do not offer OTP-first-factor if MFA is required.Same page as C4PrimaryHigh—
C6Amplify client coverage: Swift — signIn with preferredFirstFactor (smsOTP, emailOTP, webAuthn on iOS 17.4+), omit it for the choice flow, signInWithWebUI (ASWebAuthenticationSession) for managed login/social; external IdPs: Sign in with Apple, Google, Facebook, Amazon, OIDC, SAML. React Native docs list SMS OTP, email OTP and WebAuthn with no stated RN limitation. Android announced 2024-11-27 (C2).https://docs.amplify.aws/swift/build-a-backend/auth/connect-your-frontend/sign-in/ ; https://docs.amplify.aws/swift/build-a-backend/auth/concepts/external-identity-providers/ ; https://docs.amplify.aws/react-native/build-a-backend/auth/concepts/passwordless/ (all retrieved 2026-09-04)PrimaryHigh (Swift), Medium (RN — page silent on limits)REC
C7Refresh token rotation (OAuth 2.0; new refresh token on each refresh, optional grace period; GetTokensFromRefreshToken) launched 2025-04-22, Essentials/Plus. Relevant to on-device token handling.https://aws.amazon.com/about-aws/whats-new/2025/04/amazon-cognito-refresh-token-rotation/PrimaryHighREC
C82026 Cognito change: self-service provisioned API rate limits (adjust up/down on demand instead of Service Quotas tickets), 2026-07. Relevant to the 100K-user scale target.https://aws.amazon.com/about-aws/whats-new/2026/07/cognito-provisioned-limits/PrimaryHigh—
C9aws-samples/amazon-cognito-passwordless-auth (FIDO2/passkeys, magic link, SMS OTP step-up via custom auth Lambdas) predates native passkeys; useful only as a reference for custom-auth patterns. Date/licence: angle 1.https://github.com/aws-samples/amazon-cognito-passwordless-auth (retrieved 2026-09-04)Primary (repo)MediumSUP (legacy pattern)

D. Push notifications, SMS, email after Pinpoint (U1 Tier 1, U2 Tier 1 alerts)​

#FindingSource (dated)TierConfidenceStatus
D1Amazon Pinpoint end of support: 2026-10-30. No new customers since 2025-05-20. After the date the console and Pinpoint resources (endpoints, segments, campaigns, journeys, analytics) are inaccessible. This closes the catalog's "Pinpoint VERIFY" (rule 4): retired — put it on the retired list.Pinpoint migration guide https://docs.aws.amazon.com/pinpoint/latest/userguide/migrate.html and FAQ https://aws.amazon.com/pinpoint/faqs/ (retrieved 2026-09-04)PrimaryHighRetired
D2AWS-named successors, verbatim mapping: SMS, MMS, push, WhatsApp, voice, OTP, phone-number validate → AWS End User Messaging (renamed from Pinpoint channels in Q3 2024; "APIs … will not be affected"); email → Amazon SES (deliverability dashboard → SES Virtual Deliverability Manager); engagement (endpoints/segments/campaigns/journeys/analytics) → Amazon Connect Customer outbound campaigns + Customer Profiles; event collection / mobile analytics → Amazon Kinesis. Gaps AWS itself lists: In-App Messaging has no successor; push is not native in Connect Customer campaigns (journeys only, via a Lambda action). Third-party migration tooling (Pronetx) is on Marketplace.Same migration guide, retrieved 2026-09-04PrimaryHighREC
D3AWS End User Messaging Push supports APNs, FCM, Baidu, ADM (product page also lists Web Push). Its send path is still the Pinpoint API surface: aws pinpoint send-messages --application-id … / boto3.client('pinpoint').send_messages, with FCM addressed as GCM for compatibility. I.e. push after 2026-10-30 continues on the same API under the EUM brand; only the engagement layer disappears.https://aws.amazon.com/end-user-messaging/push/ ; https://docs.aws.amazon.com/push-notifications/latest/userguide/reference-send-message.html (retrieved 2026-09-04)PrimaryHighREC (AWS-named successor for push)
D4Amazon SNS mobile push remains fully documented with no deprecation note: APNs (iOS/macOS), FCM, ADM, Baidu, MPNS, WNS; platform application + endpoint model; direct publish or topic fan-out. It is the catalog-v0 U1 choice and is valid, but it is not the successor AWS names for Pinpoint push.https://docs.aws.amazon.com/sns/latest/dg/sns-mobile-application-as-subscriber.html (retrieved 2026-09-04)PrimaryHighSUP
D5Amplify's own path: Gen 1 push docs and Gen 2 analytics docs carry the banner "AWS will end support for Amazon Pinpoint on October 30, 2026 …" and recommend End User Messaging for push and SMS, SES for email, Amazon Connect for campaigns/journeys, Kinesis for events. The Swift Gen 2 docs add a "Migrate from Pinpoint-backed features" page whose extracted guidance is: analytics → Kinesis Data Streams / Data Firehose; user identification and push device registration → Amazon Connect Customer Profiles (new notifications resource; identifyUser, registerDevice, removeDevice; profiles repopulate as users sign in). Amplify JS Analytics already has a Kinesis provider (JS only). Flutter notice #6160 (2025-06-05) says Analytics and Push are affected in Flutter.https://docs.amplify.aws/gen1/swift/build-a-backend/push-notifications/set-up-push-notifications/ ; https://docs.amplify.aws/react/build-a-backend/add-aws-services/analytics/ ; https://docs.amplify.aws/swift/build-a-backend/add-aws-services/pinpoint-migration/ ; https://github.com/aws-amplify/amplify-flutter/issues/6160 (all retrieved 2026-09-04)PrimaryHigh for banners; Medium for the Customer-Profiles detail (extracted by summariser — read the page before building on it)REC (Amplify)
D6Recommendation for the catalog: for transactional push (appointment reminders, U2 anomaly alerts) either EUM Push (AWS-named successor; same Pinpoint send-messages API; templates) or SNS mobile push (simpler, topic fan-out, EventBridge → SNS fits the U2 alert path) is supported; SES for email; EUM SMS for SMS; Kinesis for client analytics. Do not use Pinpoint campaigns/journeys/in-app messaging. HIPAA eligibility of EUM, SNS, SES: angle 2.Synthesis of D1–D5—Medium—

E. Device testing and location (U1 cross-cutting)​

#FindingSource (dated)TierConfidenceStatus
E1AWS Device Farm is active: last What's New 2025-11-21 (fully managed Appium endpoint with live video/log streaming, environment variables for test sharding/filtering, IAM role assumption on test hosts). Supports native/hybrid iOS, Android, web, cross-platform apps; frameworks Appium (Java/Python/Ruby/Node), Espresso/Instrumentation, XCTest/XCUI. Uploaded apps/test packages auto-deleted after 30 days. No 2026 What's New found.https://aws.amazon.com/about-aws/whats-new/2025/11/aws-device-farm-managed-appium-endpoint ; https://aws.amazon.com/device-farm/faqs/ (retrieved 2026-09-04)PrimaryHighSUP
E2Device Farm is available in one region only: us-west-2 (devicefarm.us-west-2.amazonaws.com). Quotas: 5 concurrent metered automation devices, 2 remote-access, 150-min sessions, 4 GB upload. Implication: test binaries and any test data leave the workload's region; do not use PHI in Device Farm test data; HIPAA eligibility of Device Farm: angle 2 (FAQ has no compliance statement).https://docs.aws.amazon.com/general/latest/gr/devicefarm.html (retrieved 2026-09-04)PrimaryHigh—
E3Amazon Location Service is active and expanding in 2026: GrabMaps SE-Asia (2026-03), enhanced map styling incl. 3D terrain (2026-04), bulk address validation US/CA/AU/UK (2026-04), public-transit/intermodal routing (2026-06), enhanced Places address/search (2026-07), Search Nearby for GrabMaps (2026-07), POI category/density filtering (2026-08). Relevance to U1: clinic finder, address validation at sign-up, geofenced check-in; Amplify Geo is supported in Gen 2 via CDK on all platforms (A9).AWS What's New 2026 posts, e.g. https://aws.amazon.com/about-aws/whats-new/2026/08/amazon-location-service/amazon-location-poi-categorization-density-map-styles/ , https://aws.amazon.com/about-aws/whats-new/2026/06/amazon-location-service/amazon-location-new-public-transit-intermodal-routing/ , https://aws.amazon.com/about-aws/whats-new/2026/04/amazon-location-service-bulk-address-validation/PrimaryHighSUP (optional for catalog)

F. Phone-paired health devices into the backend (U2 Tier 1)​

F.1 The on-device stores​

#FindingSource (dated)TierConfidenceStatus
F1Apple HealthKit data is only reachable from an app running on the device; there is no Apple cloud/server API. App Store Review Guideline 5.1.3: apps "may not store personal health information in iCloud", may not use/disclose HealthKit data to third parties for advertising or data-mining, must disclose the specific health data collected, and research use needs consent + ethics-board approval. Background delivery / observer queries exist for app-side sync (Apple doc page did not render; this sub-claim is general knowledge, lower confidence).https://developer.apple.com/app-store/review/guidelines/ §5.1.3 (retrieved 2026-09-04)Primary (guidelines); general knowledge for background deliveryHigh (rules) / Medium (background-delivery detail)NONE from AWS
F2Android Health Connect (Android SDK 28+) is an on-device store with insert/update/delete, permissioned reads, background reads and a changes/sync mechanism "that allows client apps to synchronize data out of Health Connect". No cloud API.https://developer.android.com/health-and-fitness/guides/health-connect (retrieved 2026-09-04)PrimaryHighNONE from AWS
F3No AWS documentation, blog, Guidance or sample was found that ingests HealthKit or Health Connect data into IoT Core, Kinesis, HealthLake or an API. Searches: AWS blogs (site-scoped), aws-samples/awslabs GitHub, Solutions Library. Nearest AWS material is generic ("Improving the utilization of wearable device data using an AWS data lake", AWS Industries blog) and Marketplace partner connectors (e.g. WearConnect, "300+ devices incl. Apple Health"). Community: cleverdevil/healthlake (HealthKit export → S3 data lake; not AWS-maintained).Search results 2026-09-04; https://aws.amazon.com/blogs/industries/improving-the-utilization-of-wearable-device-data-using-an-aws-data-lake ; https://github.com/cleverdevil/healthlakeAbsence claim (multiple searches)Medium-HighNONE — genuine demonstration gap for U2 Tier 1

F.2 Supported phone → AWS paths​

#FindingSource (dated)TierConfidenceStatus
F4Path A — MQTT from the phone to IoT Core with Cognito identities (documented): identity pool → IAM role → plus an IoT policy attached to the Cognito identity via AttachPolicy ("If you don't attach an AWS IoT policy to the Amazon Cognito Identity, an authenticated user fails authorization"); connect with MQTT over WebSocket + SigV4. Per-user fine-grained topic policies are the intended model.https://docs.aws.amazon.com/iot/latest/developerguide/cognito-identities.html ; https://docs.aws.amazon.com/iot/latest/developerguide/cog-iot-policies.html (retrieved 2026-09-04)PrimaryHighREC (for MQTT from apps)
F5iOS SDK for Path A: AWS IoT Device SDK for Swift is GA (GA release 2026-06-01; What's New 2026-06-24; v1.1.0 2026-07-28). macOS 12+, iOS 16+, tvOS 16+, Linux; MQTT 5; X.509 mTLS, AWS-credential (SigV4) websocket, custom authorizer; Device Shadow, Jobs, Fleet Provisioning clients; TLS 1.3 on iOS; Apache-2.0. This replaces the EOS aws-sdk-ios AWSIoT client (A10). Amplify Swift has no PubSub category, so IoT from iOS = this SDK + Amplify Auth for Cognito credentials.https://aws.amazon.com/about-aws/whats-new/2026/06/aws-iot-device-sdk-swift/ ; https://github.com/aws/aws-iot-device-sdk-swift (releases.atom, retrieved 2026-09-04)PrimaryHighREC
F6Android SDK for Path A: AWS IoT Device SDK for Java v2 supports Android (software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk-android, min API 24, requires core-library desugaring; mTLS, Android KeyChain, PKCS#11 documented; SigV4/Cognito websocket is in the MQTT5 guide). Replaces the EOS aws-sdk-android IoT client. Amplify Android has no PubSub category either.https://github.com/aws/aws-iot-device-sdk-java-v2/blob/main/documents/ANDROID.md (retrieved 2026-09-04) ; IoT SDKs page (A10)PrimaryHighREC
F7Amplify PubSub (IoT Core MQTT with aws iot attach-policy) exists only in Amplify JS (React / React Native), not Swift/Android/Flutter.https://docs.amplify.aws/react/build-a-backend/add-aws-services/pubsub/set-up-pubsub/ (page dated 2024-04-29, retrieved 2026-09-04); amplify-swift README (A3)PrimaryHighSUP (JS/RN only)
F8Path B — REST/GraphQL ingest (documented, generic): app reads HealthKit/Health Connect/BLE, then calls Amplify REST (API Gateway, Cognito JWT or IAM) → FastAPI, or an Amplify Data mutation (AppSync). Backend then publishes to Kinesis/IoT Rules as needed. Available on all four clients (subject to A9 Android REST ambiguity). No AWS document prefers this over Path A for health data.B1, B5 sourcesPrimary (components)High (supported) / Medium (no recommendation)SUP
F9IoT Core credentials provider / X.509 per phone: no AWS guidance found for issuing X.509 device certificates to phones for a consumer health app; AWS's documented mobile pattern is Cognito identities (F4). Fleet Provisioning is documented for devices, not phones.IoT docs (F4), retrieved 2026-09-04—MediumNONE

F.3 Public samples (cross-reference angle 1 for the master table)​

#ArtefactWhat it showsStack / licence / dateCoverage of U2 Tier 1
F10aws-samples/aws-amplify-cdk-iot-ble-swift-app https://github.com/aws-samples/aws-amplify-cdk-iot-ble-swift-appArduino Nano 33 BLE Sense → iPhone over BLE → Swift app publishes MQTT to IoT Core → IoT Rule → S3; Cognito user pool + identity pool.CDK (TypeScript; migrated CDK v1→v2 in 2026), "AWS Amplify for iOS" via CocoaPods (older Amplify iOS line — verify it is Amplify Swift v2, not v1/aws-sdk-ios, before forking); MIT-0; initial commit 2021-08-17; last commits 2026-06-09 ("migrate CDK v1 to v2, resolve all 93 security vulnerabilities", "scope IoT policy and IAM role to least-privilege topics"). Not archived.Partial — the only AWS sample of a phone as BLE-to-IoT-Core gateway; no HealthKit, no Health Connect, no Android, no downstream pipeline. Best fork candidate for the BLE pairing chapter.
F11Solutions Library Guidance: App-based Condition Monitoring for Last-Mile Logistics on AWS https://docs.aws.amazon.com/solutions/app-based-condition-monitoring-for-last-mile-logistics-on-aws/BLE temperature sensors → Android gateway app (Cognito auth, QR pairing) → IoT Core → IoT Rules → Lambda → Aurora PostgreSQL (audit) + Timestream (time series) → API Gateway → S3/CloudFront dashboard.Architecture page + PDF diagram only; no GitHub repo found; undated. Uses "Amazon Timestream" — likely Timestream for LiveAnalytics (retired per catalog rule 4), so not linkable as-is.Architecture-only reference for the Android BLE-gateway pattern; not deployable.
F12amazon-archives/medical-mobile-iot-with-aws https://github.com/amazon-archives/medical-mobile-iot-with-awsReact Native/Expo app simulating wearable telemetry → IoT Core → Firehose/Kinesis Analytics → Connect + Lex call-outs.Archived 2020-08-07, read-only; MIT-0 code, CC-BY-SA docs; uses retired Kinesis Data Analytics.Historical only; do not link.
F13aws-samples/aws-appsync-iot-core-realtime-dashboard https://github.com/aws-samples/aws-appsync-iot-core-realtime-dashboardReact dashboard with real-time IoT sensor updates via AppSync + Amplify Gen 2 + Location Service.Details (date/licence): angle 1.Web real-time view of device data (U2 portal side), not the phone ingest.
F14AWS Blog: Real-time patient monitoring architecture on AWS for smart inhalers https://aws.amazon.com/blogs/infrastructure-and-automation/real-time-patient-monitoring-architecture-on-aws-for-smart-inhalers/BLE smart inhaler → app → IoT Core → MSK → Redshift.Blog architecture; date not captured (angle 1 if used).Pattern confirmation only; stack differs from the catalog spine.

Gaps (searched for, not found)​

  1. HealthKit or Health Connect ingestion guidance from AWS — none (F3). This is the clearest "new work has demonstration value" item in this angle: a U2 Tier 1 companion-app chapter that reads HealthKit/Health Connect (with the 5.1.3 constraints) and BLE, and forwards via Path A or B, has no AWS precedent.
  2. An AWS statement preferring AppSync vs API Gateway for a mobile+web app over a container backend — none; only the Events-vs-WebSocket decision rule (B3) and Amplify's own defaults (B1, B5).
  3. Amplify Hosting What's New in 2026 — none found by search; doc-history page did not render. Not evidence of retirement.
  4. Device Farm What's New in 2026 — none found; last 2025-11-21.
  5. A first-party Amplify native-mobile (Swift/Kotlin/RN/Flutter) healthcare sample — none; Amplify healthcare samples are web-only.
  6. GitHub repo for the last-mile BLE Guidance (F11) — not found; architecture page only.
  7. Apple HealthKit background-delivery doc page — Apple's doc URLs did not render through the fetcher; the on-device claim is grounded in App Store guideline 5.1.3 instead.
  8. Exact wording of the Amplify "Migrate from Pinpoint-backed features" page — captured via summariser only (D5); the Connect Customer Profiles detail should be re-read before it drives a design.
  9. HIPAA eligibility of AppSync, AppSync Events, API Gateway, End User Messaging, SNS, SES, Device Farm, Location, IoT Core — deliberately not researched here; angle 2 owns it.

Source list (dated)​

Primary — AWS docs / What's New / product pages

Primary — repositories (state retrieved 2026-09-04)

Primary — non-AWS platform owners

Practitioner / leads only (not relied on for claims)