2. Overview

With ROW, a device leaves the factory already registered with the Amazon Sidewalk cloud. No mobile application, Sidewalk gateway or in-field registration step is required. The device performs field activation automatically the first time it contacts the Amazon Sidewalk network over the air.

ROW uses the same cryptographic registration handshake as over-the-air registration. The difference is the transport: the sid-mfg-tool host tool running on the line PC relays the registration messages between the device (over UART or RTT) and the Amazon Sidewalk cloud (over HTTPS).

2.1 Registration over Wire and the existing mass production flow

ROW builds on the components of the existing mass production flow described in the Amazon Sidewalk Manufacturing documentation. The Device Attestation Key (DAK), the Hardware Security Module (HSM), the Advertised Product ID (APID), factory support for the device profile, control log onboarding in the Amazon FFS developer console, and the Factory Diagnostic Firmware certificate commands (cert init, cert smsn, cert csr, as shown in Step 2 of the Amazon Sidewalk Manufacturing documentation) are the same in both flows. The following table summarizes the differences.

	Existing mass production flow	Registration over Wire
Host tooling	Sidewalk signing tool, driven by a line PC script implemented by the CM	`sid-mfg-tool`, which performs signing, control log upload, device creation and registration in one session
Control log upload	EDI or SFTP endpoint	`api` (per device, from the line PC) or `sftp` (batched)
Onboarding to AWS IoT Core for Amazon Sidewalk	Bulk provisioning with an import task, using the CSV of SMSNs	Per device (`immediate`) or bulk import task (`bulk`), performed by the tool
Registration	In the field, through a Sidewalk gateway, FFN or a mobile application using the Amazon Sidewalk Mobile SDK	On the factory line; the device performs field activation on first contact with the network
Production firmware	Full SDK variant with a BLE or FSK registration path	Full SDK variant (`security-level-high`) or lite, single-link SDK variant (`security-level-low`), including LoRa-only devices

A device follows exactly one of these models. Do not mix the two flows on the same device.

2.2 Roles

The work is split across three roles. One person or organization may hold more than one role.

Role	Responsible for	Chapters
Device maker	One-time onboarding: control log onboarding, LWA security profile, scope allow-listing, AWS IoT Core for Amazon Sidewalk, HSM provisioning and factory support	Chapter 3
Contract manufacturer (CM) line operator	Line PC setup, the per-device flow, and gating the factory line on the verification step	Chapter 4 and Chapter 5
Firmware engineer	Factory Diagnostic Firmware and production firmware, including a matching security level and storage layout	Chapter 6 and Chapter 7

Chapter 3 includes requests to Amazon that carry external lead time. Start it at the beginning of the project, alongside the firmware bring-up (Section 2.3).

2.3 Bring-up sequence

Two tracks run in parallel and converge on the line PC:

Track A: Amazon onboarding. Complete the onboarding in Chapter 3, including scope allow-listing and the APID. Purchase the YubiHSM 2 unit and ship it to Amazon. Amazon provisions the production DAK on the HSM and returns it, together with the DAK PIN. Start this track at the beginning of the project, because its requests to Amazon carry lead time. Track B runs alongside it.
Track B: Firmware bring-up. Build a Factory Diagnostic Firmware image with ROW support. The image is built for the host interface used on the line, UART or RTT (Section 6.1). Use the sid_diagnostics reference application where it exists for your platform, or your own Factory Diagnostic Firmware with ROW integrated as described in Chapter 6.

flowchart TD
    subgraph A["Track A: Amazon onboarding (Chapter 3)"]
        A1["Accounts, LWA security profile,\nscope allow-listing,\nAWS IoT Core for Amazon Sidewalk (3.1-3.4)"]
        A2["Request factory support and\nship the YubiHSM 2 unit to Amazon (3.5)"]
        A3["Amazon links the APID,\nprovisions the production DAK,\nreturns the HSM and DAK PIN"]
        A1 --> A2 --> A3
    end
    subgraph B["Track B: Firmware bring-up (in parallel)"]
        B1["Build Factory Diagnostic Firmware with ROW:\nsid_diagnostics reference application,\nor ROW integrated into your own firmware"]
    end
    A3 -->|"Provisioned HSM and DAK PIN"| WS["Line PC setup (Chapter 4)"]
    WS --> PD["Per-device flow (Chapter 5):\nflash, onboard, verify"]
    B1 -->|"Factory Diagnostic Firmware image"| PD
    B1 ~~~ A2

Figure 1: Registration over Wire bring-up sequence