Integrating TEKTELIC KONA Gateways with AWS IoT Core for LoRaWAN

This guide describes how to connect TEKTELIC KONA LoRaWAN® gateways to AWS IoT Core for LoRaWAN using the LoRa Basics™ Station protocol. The procedure uses the KONA Link web interface and requires no command-line access to the gateway.

Before you begin, ensure your gateway firmware supports LoRa Basics™ Station (BSP v7.2.x or later).

• An AWS account
• A TEKTELIC KONA gateway with the required BSP version and LoRa Basics™ Station installed
• Internet access for the gateway

The IAM Role allows the AWS Configuration and Update Server (CUPS) to manage gateway credentials. This step only needs to be done once per AWS account.

1. Go to the AWS IAM Console → Policies → Create policy.

2. Select the JSON tab and replace the content with the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IoTWirelessGatewayCertManager",
      "Effect": "Allow",
      "Action": [
        "iot:CreateKeysAndCertificate",
        "iot:DescribeCertificate",
        "iot:ListCertificates",
        "iot:RegisterCertificate"
      ],
      "Resource": "*"
    }
  ]
}

3. Choose Next, name the policy AWSIoTWirelessGatewayCertManager, and click Create policy.

4. Go to Roles → Create role → AWS account → This account → Next.

• Attach the policy AWSIoTWirelessGatewayCertManager.

• Name the role IoTWirelessGatewayCertManagerRole.
• Select Create role.

5. Edit the new role’s Trust relationship and update it as follows:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": "iotwireless.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }
   

6. Save the trust policy by choosing Update policy.

1. Open the AWS IoT Core for LoRaWAN Console → LPWAN devices → Gateways → Add gateway.

2. Enter the following information:

   • Gateway EUI – printed on the gateway label.
   • Frequency band – select the appropriate LoRaWAN region (e.g., US915, EU868).
   • Optionally, enter a name for the gateway.

3. Click Add gateway.

4. On the Configure your gateway page:

   • Choose Create certificate.
   • Download the certificate (xxxx.cert.pem) and private key (xxxx.private.key).

5. Rename and duplicate the files as follows:

   cups.crt     ← xxxx.cert.pem
   cups.key     ← xxxx.private.key
   

6. Under Provisioning credentials, choose Download server trust certificates.

   • Keep cups.trust as is.

7. Copy the endpoint URLs:

• Create a text file named cups.uri containing your CUPS endpoint (e.g.):

  https://EXAMPLE.cups.us-east-1.amazonaws.com:443
  

8. You should now have the following four files ready:

   cups.uri
   cups.trust
   cups.crt
   cups.key
   

9. Select the role IoTWirelessGatewayCertManagerRole and click Submit to complete gateway registration.

Once the AWS side setup is complete, configure the gateway through KONA Link.

1. Log in to KONA Link using your gateway’s hostname or IP address:

http://kona-<model>-<last 6 digits of ID>.local/

http://<GW IP address>/

2. From the main menu, select Setup Wizards → LoRa Basics Station Setup.

3. When prompted, ensure that the gateway is not connected to KONA Core. Click Next to continue.

4. Select the frequency subband that matches your AWS region (default is 2).

5. Upload all four files prepared earlier:

   cups.uri
   cups.trust
   cups.crt
   cups.key
   

6. Click Next, then Done.

7. Reboot the gateway when prompted.

After the gateway restarts:

1. In KONA Link, confirm that the Basics Station status shows Connected.
2. In the AWS IoT Console, go to: Manage → LPWAN devices → Gateways
3. Verify that the Last uplink received field shows a recent timestamp.

If data is flowing, your KONA gateway is successfully connected to AWS IoT Core for LoRaWAN.

You have now integrated your TEKTELIC KONA gateway with AWS IoT Core for LoRaWAN using the LoRa Basics™ Station protocol and the KONA Link web interface. All security credentials are managed using AWS IAM and CUPS/LNS trust files, providing a secure and reliable connection between your gateway and AWS IoT Core.