The push messages go to the AWS server to connect to your phone. Much like ANY P2P application I suppose.
I'm not a network egineer or security expert, but I did sleep at a Holiday Inn Express once and near as I can tell, WireGuard VPN, OpenVPN, Tailscale and others all use the same handshake...