AWS IoT Core: LoRaWAN Gateway Setup Guide

For enterprises building scalable IoT solutions, AWS IoT Core for LoRaWAN is a game-changer. It eliminates the need for a third-party Network Server (like ChirpStack), allowing your LoRaWAN gateway to talk directly to the AWS cloud. This guide provides a technical walkthrough for connecting a Robustel gateway to AWS. We explain the "Basic Station" protocol, the importance of CUPS (Configuration and Update Server), and how to manage the strict TLS security requirements to ensure your industrial data flows securely into AWS services like DynamoDB and Lambda.

In the past, connecting LoRaWAN to the cloud was a three-step dance: Sensor -> Gateway -> Network Server -> Cloud. Amazon Web Services (AWS) simplified this. With "AWS IoT Core for LoRaWAN," they internalized the Network Server.

Now, your LoRaWAN gateway connects directly to AWS.

This architecture reduces complexity and costs, but it requires precise configuration. AWS does not support the insecure legacy "UDP Packet Forwarder." It demands LoRa Basics Station, a secure, robust protocol.

This guide walks you through connecting a Robustel industrial LoRaWAN gateway (like the R1520LG) to the AWS ecosystem.

Before starting, ensure you have:

1. An AWS Account: With administrative access to IoT Core.
2. A Robustel LoRaWAN Gateway: Updated to the latest RobustOS firmware (which supports Basic Station).
3. Gateway EUI: The 16-character unique ID found on the device label or web interface.

1. Log in to the AWS Console and navigate to IoT Core.
2. In the sidebar, select Wireless Connectivity > Gateways.
3. Click Add gateway.
4. Gateway EUI: Enter your device's EUI (e.g., a84041ffff123456).
5. Frequency Band: Select the correct region (e.g., US915 or EU868).
6. Name: Give your LoRaWAN gateway a recognizable name (e.g., Production-Gateway-01).

This is the most critical step. AWS uses Mutual TLS (mTLS) authentication.

1. After clicking "Add gateway," AWS will prompt you to Create a certificate.
2. Download the following three files immediately (you cannot download them later):

• Gateway Certificate (.pem.crt)
• Private Key (.pem.key)
• Trust Anchor (Root CA certificate, usually cups.trust)

3. Also, copy the CUPS Endpoint URL displayed on the screen (starts with https://...).

You now have the "digital keys" required to unlock the AWS door for your LoRaWAN gateway.

Now, move to the hardware side.

1. Log in to the RobustOS web interface of your gateway.
2. Navigate to LoRaWAN > Packet Forwarder.
3. Protocol: Select Basic Station.
4. Backend Mode: Select CUPS (Configuration and Update Server). This allows AWS to push LNS settings automatically.
5. URI: Paste the CUPS Endpoint URL you copied from AWS.
6. Authentication Mode: Select TLS Client Authentication.
7. Upload Certificates: Upload the three files you downloaded from AWS:

• CA Certificate: The Trust Anchor.
• Client Certificate: The Gateway Certificate.
• Client Key: The Private Key.

8. Click Save & Apply.

The LoRaWAN gateway will restart its LoRa service. It initiates a secure WebSocket connection to the AWS CUPS endpoint.

1. Return to the AWS IoT Core Console.
2. Refresh the Gateways list.
3. Look at the Last uplink received timestamp.
4. Status: It should change from "Disconnected" to Connected.

If it says "Connected," your LoRaWAN gateway is now a fully authenticated node in the AWS cloud. Any LoRaWAN sensor data received by this gateway will be available in the AWS IoT Core MQTT broker (dt/lorawan/...).

You might ask, "Why is this harder than the old UDP method?" Security. The legacy UDP protocol sends data in plain text. Basic Station wraps everything in a TLS tunnel. For industrial users, this means your LoRaWAN gateway is compliant with strict enterprise security standards (SOC2, ISO 27001) out of the box, as no unencrypted data ever travels over the public internet.

By connecting your LoRaWAN gateway directly to AWS, you unlock the full power of the cloud. You can route sensor data to DynamoDB for storage, trigger Lambda functions for alerts, or visualize trends in QuickSight—all without managing a single server.

Robustel’s native support for the Basic Station protocol makes this integration seamless, providing a rugged, secure on-ramp for your industrial data journey.