How can a client(hardware) can connect to AWS iot-core. One way is the using certificate and private key.

I don’t want to expose my private key to OEM(Soundbox) provide. is there any other way to subscribe to IOT-Core like using IAM role or any other medium.

We have soundbox device which is always listen from IOT_core. they can changes any thing in the hardware. so how can soundbox device can listen from IOT-core using username and password or other ?