AWS IoT Device Defender with Device Shadows.

Hi. AWS IoT Device Defender audits don't require your devices to be connected when the audit is performed. Please review the checks included in an audit: https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-audit-checks.html. Consider for example 'Device certificate shared':

When performed as part of an on-demand audit, this check looks at the certificates and client IDs that were used by devices to connect during the 31 days before the start of the audit up to 2 hours before the check is run. For scheduled audits, this check looks at data from 2 hours before the last time the audit was run to 2 hours before the time this instance of the audit started.

https://docs.aws.amazon.com/iot/latest/developerguide/audit-chk-device-cert-shared.html

You don't need to involve shadows to perform audits.

I would also recommend you not run audits hourly. I think if you review the audit checks performed, they are not so dynamic.