Skip to main content Link Menu Expand (external link) Document Search Copy Copied

3. One-Time Onboarding

Complete the steps in this chapter before starting factory work. Sections 3.1 to 3.3 are performed once per company, because they are tied to your Amazon developer account and not to a product. Sections 3.4 and 3.5 are repeated for each product, because the device profile, APID and DAK belong to a single device type.

Two steps require an action from Amazon. Submit these requests to Amazon Sidewalk support through the Amazon Sidewalk 360 portal early, because they carry external lead time.

Step What you request What you provide
3.3 Scope allow-listing Allow-list your LWA security profile for the sidewalk::manage_endpoint and frustration_free_setup::device:control_log scopes Vendor ID, Customer ID, LWA Client ID, Security Profile ID, AWS account ID, device profile ID
3.5 HSM provisioning and factory support Provision the production DAK on your YubiHSM 2 unit, generate or link the APID for your device profile, and vend the DeviceTypeId The seven items listed in Section 3.5

3.1 Control log onboarding

Control log onboarding is the same step used by the existing mass production flow.

  1. Sign in to your Amazon developer account and go to the Amazon Frustration-Free Setup (Amazon FFS) developer console at developer.amazon.com/frustration-free-setup/console.
  2. Go to the Control Logs section and choose Manage Control Logs.
  3. Enter information about the business you want to onboard, which includes the Company Name, Contact name, Group Email and Contact phone. Use a group mailbox rather than a personal address, because it receives the control log notifications.
  4. Choose Onboard.

This registers your business for control log ingestion. During device onboard, sid-mfg-tool then uploads the control log for each device.

Figure 2: Onboarding a business for control logs in the Amazon FFS developer console

3.2 Login with Amazon (LWA)

sid-mfg-tool authenticates to the Amazon Sidewalk cloud with Login with Amazon (LWA).

  1. In the Amazon developer portal, create a security profile under Login with Amazon.
  2. Under Web Settings, add exactly http://localhost:8000/ to Allowed Return URLs. The tool’s browser login receives the authorization code on a local listener at this address, and LWA only redirects to a return URL that is registered on the security profile. Leave Allowed Origins empty.
  3. Record the Client ID and Client Secret shown under Web Settings, and the Security Profile ID shown on the profile’s General tab.
  4. Record your Vendor ID and Customer ID from the Customer Details page at developer.amazon.com/settings/console/mycid.

Figure 3: LWA security profile Web Settings

3.3 Scope allow-listing

Amazon must allow-list the security profile from Section 3.2 for both of the following scopes:

  • sidewalk::manage_endpoint
  • frustration_free_setup::device:control_log

Contact Amazon Sidewalk support with the details listed in the table at the start of this chapter. Until sidewalk::manage_endpoint is allow-listed, the tool’s browser login fails with invalid parameter : scope. Until frustration_free_setup::device:control_log is allow-listed, the first device onboard fails at the control log upload with LWA client_credentials returned 400.

3.4 AWS IoT Core for Amazon Sidewalk

AWS IoT Core for Amazon Sidewalk is available only in the us-east-1 Region.

  1. Create a device profile and a destination in us-east-1.
  2. Record the device profile ID and the application server public key (64 hexadecimal characters) shown on the device profile page.
  3. Create a named AWS CLI profile that is allowed to call sts:GetCallerIdentity and iotwireless:CreateWirelessDevice. If you use bulk device creation (see Chapter 4), the profile also needs the iotwireless:*WirelessDeviceImportTask actions and S3 PutObject.

sid-mfg-tool uses only this named profile. It does not fall back to default credentials.

After Amazon has provisioned your HSM (Section 3.5), the APID appears on the same device profile page. You can also obtain it with the GetDeviceProfile API operation or the aws iotwireless get-device-profile CLI command. The DeviceTypeId is vended by Amazon together with the HSM.

3.5 HSM provisioning and factory support

HSM provisioning is the same step used by the existing mass production flow. Purchase a YubiHSM 2 unit directly from Yubico and submit the request described in “Getting an HSM Provisioned” in the Amazon Sidewalk Manufacturing documentation.

Amazon provisions the production DAK on the HSM, generates or links the APID for your device profile, vends the DeviceTypeId and ships the HSM back. Amazon sends the DAK PIN by encrypted email, together with the product tag that identifies the DAK in the HSM. The product tag is the same value the Sidewalk signing tool accepts as --product (for example RNET_DAK_<PROJECT>), and is entered as the product name in sid-mfg-tool configure (Chapter 4).

The APID must be linked to your device profile (factory support) before any devices are provisioned.

Back to top

©2023 Amazon.com, Inc. or its affiliates (collectively, “Amazon”). All Rights Reserved.