There shouldn’t be any direct communication with aws servers from a resin device. Can you send us more details about the traffic you are seeing so we can debug this further?
I’m sorry, I misunderstood your question. As you mentioned in your post, we connect to *.resin.io and *.pubnub.com from the device. *.resin.io includes vpn.resin.io, which is our VPN endpoint. Devices connect to that endpoint to enable 2-way communication, and features like the web terminal. Additionally, devices will contact various other *.resin.io domains, such as registry2.resin.io to pull down Docker images when performing updates.