Systems and methods herein represent an IoT device as an endpoint of private cloud. A virtualization service receives an IoT identifier for an IoT device and a network address for a virtual endpoint for the IoT device. The virtual endpoint for the IoT device is included in a host cloud platform. The virtualization service maps the IoT identifier to the network address in a distributed data structure for the service provider network and provides instructions, for an edge node for the service provider network, to provide network-layer access controls based on the mapping. The edge node for the service provider network receives an access request from the IoT device, applies a network-layer access control for the IoT device based on the instructions, receive IoT data from the IoT device when the edge node permits access by the IoT device, and forwards the IoT data to the virtual endpoint.