did the Jun 9 Security Update remove trusted (amazon) certs?

We haven't seen it across our environment, but your findings do sound consistent with a trust store issue rather than an AWS IoT problem.

If manually importing Amazon Root CA 1 immediately restores the connection, that strongly suggests the TLS handshake is failing because the client can no longer build a trusted certificate chain. AWS IoT endpoints themselves haven't had a broad certificate change that would explain this behavior on its own.

One thing I would check is whether the affected machines have Automatic Root Certificates Update disabled (via Group Policy or registry) or if they were unable to reach Microsoft's root certificate update service. Windows doesn't necessarily have every trusted root preinstalled it can download roots on demand under the right conditions.

It's also interesting that only about two-thirds of your fleet was affected. That makes me wonder if there's a common factor, such as:

Different Windows builds or patch levels

Different GPOs affecting certificate management

Machines that haven't accessed HTTPS endpoints using the Amazon trust chain recently

Restricted internet access preventing automatic root updates

I'd be interested to know which Windows versions and KB updates the affected systems have installed. If they're all on the same cumulative update, that could help determine whether this was caused by a Windows update or by differences in how the root certificate store was maintained.