# Get started
Before you begin, you should familiarize yourself with the basic concepts in AWS Ground Station. For more information, see [How AWS Ground Station works](how-it-works.md).
Below are the best practices for AWS Identity and Access Management (IAM) and what permissions you will need. After setting up the appropriate roles you can begin following the remainder of the steps.
## Sign up for an AWS account
If you do not have an AWS account, complete the following steps to create one.
**To sign up for an AWS account**
1. Open [https://portal.aws.amazon.com/billing/signup](https://portal.aws.amazon.com/billing/signup).
1. Follow the online instructions.
Part of the sign-up procedure involves receiving a phone call or text message and entering a verification code on the phone keypad.
When you sign up for an AWS account, an *AWS account root user* is created. The root user has access to all AWS services and resources in the account. As a security best practice, assign administrative access to a user, and use only the root user to perform [tasks that require root user access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#root-user-tasks).
AWS sends you a confirmation email after the sign-up process is complete. At any time, you can view your current account activity and manage your account by going to [https://aws.amazon.com/](https://aws.amazon.com/) and choosing **My Account**.
## Create a user with administrative access
After you sign up for an AWS account, secure your AWS account root user, enable AWS IAM Identity Center, and create an administrative user so that you don't use the root user for everyday tasks.
**Secure your AWS account root user**
1. Sign in to the [AWS Management Console](https://console.aws.amazon.com/) as the account owner by choosing **Root user** and entering your AWS account email address. On the next page, enter your password.
For help signing in by using root user, see [Signing in as the root user](https://docs.aws.amazon.com/signin/latest/userguide/console-sign-in-tutorials.html#introduction-to-root-user-sign-in-tutorial) in the *AWS Sign-In User Guide*.
1. Turn on multi-factor authentication (MFA) for your root user.
For instructions, see [Enable a virtual MFA device for your AWS account root user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html) in the *IAM User Guide*.
**Create a user with administrative access**
1. Enable IAM Identity Center.
For instructions, see [Enabling AWS IAM Identity Center](https://docs.aws.amazon.com//singlesignon/latest/userguide/get-set-up-for-idc.html) in the *AWS IAM Identity Center User Guide*.
1. In IAM Identity Center, grant administrative access to a user.
For a tutorial about using the IAM Identity Center directory as your identity source, see [ Configure user access with the default IAM Identity Center directory](https://docs.aws.amazon.com//singlesignon/latest/userguide/quick-start-default-idc.html) in the *AWS IAM Identity Center User Guide*.
**Sign in as the user with administrative access**
+ To sign in with your IAM Identity Center user, use the sign-in URL that was sent to your email address when you created the IAM Identity Center user.
For help signing in using an IAM Identity Center user, see [Signing in to the AWS access portal](https://docs.aws.amazon.com/signin/latest/userguide/iam-id-center-sign-in-tutorial.html) in the *AWS Sign-In User Guide*.
**Assign access to additional users**
1. In IAM Identity Center, create a permission set that follows the best practice of applying least-privilege permissions.
For instructions, see [ Create a permission set](https://docs.aws.amazon.com//singlesignon/latest/userguide/get-started-create-a-permission-set.html) in the *AWS IAM Identity Center User Guide*.
1. Assign users to a group, and then assign single sign-on access to the group.
For instructions, see [ Add groups](https://docs.aws.amazon.com//singlesignon/latest/userguide/addgroups.html) in the *AWS IAM Identity Center User Guide*.
## Add AWS Ground Station permissions to your AWS account
To use AWS Ground Station without requiring an administrative user, you need to create a new policy and attach it to your AWS account.
1. Sign in to the AWS Management Console and open the [IAM console](https://console.aws.amazon.com/iam).
1. Create a new policy. Use the following steps:
1. In the navigation pane, choose **Policies** and then choose **Create Policy**.
1. In the **JSON** tab, edit the JSON with one of the following values. Use the JSON that works best for your application.
+ For Ground Station administrative privileges, set **Action** to **groundstation:\$1** as follows:
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"groundstation:*"
],
"Resource": [
"*"
]
}
]
}
```
------
+ For Read-only privileges, set **Action** to **groundstation:Get\$1**, **groundstation:List\$1**, and **groundstation:Describe\$1** as follows:
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"groundstation:Get*",
"groundstation:List*",
"groundstation:Describe*"
],
"Resource": [
"*"
]
}
]
}
```
------
+ For additional security through multifactor authentication, set **Action** to **groundstation:\$1**, and **Condition/Bool** to **aws:MultiFactorAuthPresent:true** as follows:
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "groundstation:*",
"Resource": "*",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": true
}
}
}
]
}
```
------
1. In the IAM console, attach the policy you created to the desired user.
For more information about IAM users and attaching policies, see the [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html).
# Onboard satellite
Onboarding a satellite into AWS Ground Station is a multistep process involving data collection, technical validation, spectrum licensing, with integration and testing. There are also non-disclosure agreements (NDAs) required.
## Customer onboarding process overview
Satellite onboarding is a manual process that can be found on the [Satellites and Resources](https://console.aws.amazon.com/groundstation/home#resources) section of the AWS Ground Station console page. The following describes the overall process.
1. Review the [AWS Ground Station Locations](aws-ground-station-antenna-locations.md) section to determine if your satellite meets the geographical and radio frequency characteristics.
1. To start onboarding your satellite to AWS Ground Station, please submit a Satellite Onboarding Questionnaire on the [Satellites and Resources](https://console.aws.amazon.com/groundstation/home#resources) section of the AWS Ground Station console page. Please include a brief summary of your mission and satellite needs, including your organization name, the frequencies required, when the satellites will be or were launched, the satellite's orbit type, and if you plan to use [Use the AWS Ground Station digital twin feature](digital-twin.md).
1. Once your request is reviewed and approved, AWS Ground Station will apply for regulatory licensing at the specific locations you plan to use. The duration of this step will vary depending on the locations and any existing regulations.
1. After this approval is obtained, your satellite will be visible for you to use. AWS Ground Station will send you a notification of the successful update.
## (Optional) Naming satellites
After onboarding, you may want to add a name to your satellite record to more easily recognize it. The AWS Ground Station console has the ability to display a user defined name for a satellite along with the Norad ID when using the Contacts page. Displaying the satellite name makes it much easier to select the correct satellite when scheduling. To do this, [tags](https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/what-are-tags.html) can be used.
Tagging AWS Ground Station Satellites can be done via the [ tag-resource ](https://docs.aws.amazon.com/cli/latest/reference/groundstation/tag-resource.html) API with the AWS CLI or one of the AWS SDKs. This guide will cover using the AWS Ground Station CLI to tag the public broadcast satellite Aqua (Norad ID 27424) in `us-west-2`.
**AWS Ground Station CLI**
The AWS CLI can be used to interact with AWS Ground Station. Before using AWS CLI to tag your satellites, the following AWS CLI prerequisites must be fulfilled:
+ Ensure that AWS CLI is installed. For information about installing AWS CLI, see [Installing the AWS CLI version 2](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html).
+ Ensure that AWS CLI is configured. For information about configuring AWS CLI, see [Configuring the AWS CLI version 2](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html).
+ Save your frequently used configuration settings and credentials in files that are maintained by the AWS CLI. You need these settings and credentials to reserve and manage your AWS Ground Station contacts with AWS CLI. For more information about saving your configuration and credential settings, see [ Configuration and credential file settings ](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).
Once AWS CLI is configured and ready to use, review the [AWS Ground Station CLI Command Reference ](https://docs.aws.amazon.com/cli/latest/reference/groundstation/index.html) page to familiarize yourself with available commands. Follow the AWS CLI command structure when using this service and prefix your commands with `groundstation` to specify AWS Ground Station as the service you want to use. For more information on the AWS CLI command structure, see [Command Structure in the AWS CLI ](https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-commandstructure.html) page. An example command structure is provided below.
```
aws groundstation [options and parameters]
```
**Name a Satellite**
First you need to get the ARN for the satellite(s) you wish to tag. This can be done via the [ list-satellites ](https://docs.aws.amazon.com/cli/latest/reference/groundstation/list-satellites.html) API in the AWS CLI:
```
aws groundstation list-satellites --region us-west-2
```
Running the above CLI command will return an output similar to this:
```
{
"satellites": [
{
"groundStations": [
"Ohio 1",
"Oregon 1"
],
"noradSatelliteID": 27424,
"satelliteArn": "arn:aws:groundstation::111111111111:satellite/11111111-2222-3333-4444-555555555555",
"satelliteId": "11111111-2222-3333-4444-555555555555"
}
]
}
```
Find the satellite you wish to tag and note down the `satelliteArn`. One important caveat for tagging is that the [ tag-resource ](https://docs.aws.amazon.com/cli/latest/reference/groundstation/tag-resource.html) API requires a regional ARN, and the ARN returned by [list-satellites ](https://docs.aws.amazon.com/cli/latest/reference/groundstation/list-satellites.html) is global. For the next step, you should augment the ARN with the region you would like to see the tag in (likely the region you schedule in). For this example, we are using `us-west-2`. With this change, the ARN will go from:
```
arn:aws:groundstation::111111111111:satellite/11111111-2222-3333-4444-555555555555
```
to:
```
arn:aws:groundstation:us-west-2:111111111111:satellite/11111111-2222-3333-4444-555555555555
```
In order to show the satellite name in the console, the satellite must have a tag with ` “Name"` as the key. Additionally, because we are using the AWS CLI, the quotation marks must be escaped with a backslash. The tag will look something like:
```
{\"Name\":\"AQUA\"}
```
Next, you will call the [tag-resource ](https://docs.aws.amazon.com/cli/latest/reference/groundstation/tag-resource.html) API to tag the satellite. This can be done with the AWS CLI like so:
```
aws groundstation tag-resource --region us-west-2 --resource-arn arn:aws:groundstation:us-west-2:111111111111:satellite/11111111-2222-3333-4444-555555555555 --tags '{"Name":"AQUA"}'
```
After doing this, you'll be able to see the name you set for the satellite in the AWS Ground Station console.
**Change the Name For a Satellite**
If you want to change the name for a satellite, you can simply call [ tag-resource ](https://docs.aws.amazon.com/cli/latest/reference/groundstation/tag-resource.html) with the satellite ARN again with the same `“Name”` key, but with a different value in the tag. This will update the existing tag and show the new name in the console. An example call for this looks like:
```
aws groundstation tag-resource --region us-west-2 --resource-arn arn:aws:groundstation:us-west-2:111111111111:satellite/11111111-2222-3333-4444-555555555555 --tags '{"Name":"NewName"}'
```
**Remove the Name For a Satellite**
The name set for a satellite can be removed with the [untag-resource ](https://docs.aws.amazon.com/cli/latest/reference/groundstation/untag-resource.html) API. This API needs the satellite ARN with the region the tag is in, and a list of tag keys. For the name, the tag key is `“Name”`. An example call to this API using the AWS CLI looks like:
```
aws groundstation untag-resource --region us-west-2 --resource-arn arn:aws:groundstation:us-west-2:111111111111:satellite/11111111-2222-3333-4444-555555555555 --tag-keys Name
```
## Public broadcast satellites
In addition to onboarding your own satellites, you may request to onboard with supported public broadcast satellites that provide a publicly accessible downlink communication path. This enables you to use AWS Ground Station to downlink data from these satellites.
**Note**
You will not be able to uplink to these satellites. You will only be able to use the publicly accessible downlink communication paths.
AWS Ground Station supports onboarding of the following satellites to downlink direct broadcast data:
+ Aqua
+ SNPP
+ JPSS-1/NOAA-20
+ Terra
Once onboarded, these satellites can be accessed for immediate use. AWS Ground Station maintains a number of preconfigured CloudFormation templates to make getting started with the service easier. See [Example mission profile configurations](examples.md) for examples of how AWS Ground Station can be used.
For more information about these satellites and the kind of data they transmit, see [Aqua](https://aqua.nasa.gov/), [JPSS-1/NOAA-20 and SNPP](https://www.nesdis.noaa.gov/our-satellites/currently-flying/joint-polar-satellite-system), and [Terra](https://terra.nasa.gov/).
# Plan your dataflow communication paths
You have the choice between synchronous and asynchronous communication for each communication path on your satellite. Depending on your satellite and your use case, you may require one or both types. Synchronous communication paths allow for near real-time uplink as well as narrowband and wideband downlink operations. Asynchronous communication paths support narrowband and wideband downlink operations only.
## Asynchronous data delivery
With data delivery to Amazon S3, your contact data is delivered asynchronously to an Amazon S3 bucket in your account. Your contact data is delivered as packet capture (pcap) files to allow replaying the contact data into a Software Defined Radio (SDR) or to extract the payload data from the pcap files for processing. The pcap files are delivered to your Amazon S3 bucket every 30 seconds as contact data is received by the antenna hardware to allow processing contact data during the contact if desired. Once received, you can process the data using your own post-processing software or use other AWS services like Amazon SageMaker AI or Amazon Rekognition. Data delivery to Amazon S3 is only available for downlinking data from your satellite; it is not possible to uplink data to your satellite from Amazon S3.
![\[Diagram showing data flow from Satellite to AWS Ground Station to S3 Bucket within AWS Cloud.\]](http://docs.aws.amazon.com/ground-station/latest/ug/images/s3-data-delivery.png)
To utilize this path, you will use need to create an Amazon S3 bucket for AWS Ground Station to deliver the data into. In the next step, you'll also need to create a *S3 Recording Config* in the next step. Please reference the [Amazon S3 Recording Config](how-it-works.config.md#how-it-works.config-s3-recording) for restrictions on bucket naming and how to specify the naming convention used for your files.
## Synchronous data delivery
With data delivery to Amazon EC2, your contact data is streamed to and from your Amazon EC2 instance. You can process your data in real-time on your Amazon EC2 instance or forward the data for post-processing.
To utilize a synchronous path, you will use need to set up and configure your Amazon EC2 instances and create one or more *Dataflow Endpoint Groups*. To configure your Amazon EC2 instance reference the [Set up and configure Amazon EC2](dataflows.ec2-configuration.md). To create your Dataflow Endpoint Group, please reference the [Use AWS Ground Station Dataflow endpoint groups](how-it-works.dataflow-endpoint-group.md).
The following shows the communication path if you are using the dataflow endpoint configuration.
![\[Diagram showing data flow from satellite to AWS Ground Station to customer VPC and application.\]](http://docs.aws.amazon.com/ground-station/latest/ug/images/ec2-data-delivery.png)
The following shows the communication path if you are using the AWS Ground Station Agent configuration.
![\[Communication flow between AWS Ground Station antenna and customer destination region components.\]](http://docs.aws.amazon.com/ground-station/latest/ug/images/digif-data-delivery-overview.png)
# Plan your telemetry
AWS Ground Station telemetry is an optional feature that streams metrics from AWS Ground Station antennas to your AWS account during satellite contacts. This allows you to monitor contact performance in near real-time and build custom monitoring solutions.
With AWS Ground Station telemetry, metrics from AWS Ground Station antennas are streamed directly to your account. Telemetry data begins streaming at contact start and continues throughout the contact duration. The telemetry data is delivered to your account in near real-time as it is sampled from the antenna hardware. Once received, you can process the data using your own post-processing software or use other AWS services like Amazon Data Firehose or AWS Lambda.
![\[Diagram showing telemetry data flow from AWS Ground Station to Amazon Kinesis Data Streams within AWS Cloud.\]](http://docs.aws.amazon.com/ground-station/latest/ug/images/telemetry.png)
In the next step, you'll create the configs needed for your mission profile. If you want to enable telemetry, you'll create a *Telemetry Sink Config* in addition to your tracking config and dataflow configs. For detailed setup instructions, see [Set up telemetry](telemetry.setup.md).
For more information about TelemetrySinkConfig, see [Telemetry Sink Config](how-it-works.config.md#how-it-works.config-telemetry-sink).
# Create configs
By this step you have identified the satellite, the communication paths, and the IAM, Amazon EC2, and Amazon S3 resources as needed. In this step you will create AWS Ground Station *configs* that store their respective parameters.
## Data delivery configs
The first configs to create relate to where and how you want data delivered. Using the information from the previous step you will construct many of the following configuration types.
+ **[Amazon S3 Recording Config](how-it-works.config.md#how-it-works.config-s3-recording)** - Deliver data to your Amazon S3 bucket.
+ **[Dataflow Endpoint Config](how-it-works.config.md#how-it-works.core-config-dfe)** - Deliver data to your Amazon EC2 instance.
## Telemetry config (optional)
If you want to receive near real-time telemetry during your contacts, you can create a TelemetrySinkConfig. This config is optional and specifies where AWS Ground Station will deliver telemetry data.
+ **[Telemetry Sink Config](how-it-works.config.md#how-it-works.config-telemetry-sink)** - Deliver telemetry data to your account.
For detailed setup instructions, see [Set up telemetry](telemetry.setup.md).
## Satellite configs
The satellite configs relate how AWS Ground Station can communicate with your satellite. You will reference the information you gathered in [Onboard satellite](getting-started.step1.md).
+ **[Tracking Config](how-it-works.config.md#how-it-works.config-tracking)** - Sets preference for how your vehicle is physically tracked during a contact. This is required for mission profile construction.
+ **[Antenna Downlink Config](how-it-works.config.md#how-it-works.config-antenna-downlink)** - Deliver digitized radio frequency data.
+ **[Antenna Downlink Demod Decode Config](how-it-works.config.md#how-it-works.config-antenna-downlink-demod-decode)** - Deliver demodulated and decoded radio frequency data.
+ **[Antenna Uplink Config](how-it-works.config.md#how-it-works.config-antenna-uplink)** - Uplink data to your satellite.
+ **[Antenna Uplink Echo Config](how-it-works.config.md#how-it-works.config-antenna-uplink-echo)** - Deliver an echo of your uplink signal data.
# Create mission profile
With the *configs* constructed in the previous step, you have identified how to track your satellite, the possible ways to communicate with your satellite, and how to enable near real-time telemetry during contact execution. In this step you will construct one or more mission profiles. A mission profile represents the aggregation of the possible *configs* into an expected behavior that can be then scheduled and operated on.
For the latest parameters, please reference the [ AWS::GroundStation::MissionProfile CloudFormation resource type ](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-groundstation-missionprofile.html)
1. Name your mission profile. This allows you to quickly understand its usage within your system. For example, you may have a *satellite-wideband-narrowband-nominal-operations* and a *satellite-narrowband-emergency-operations* if you have a separate narrowband carrier for emergency operations.
1. Set your tracking config.
1. Set your minimum viable contact durations. This allows you to filter potential contacts to meet your mission needs.
1. Set your *streamsKmsKey* and *streamsKmsRole* that are used to encrypt your data during transit. This is used for all AWS Ground Station Agent dataflows.
1. Set your dataflows. Create your dataflows to match your carrier signals using the configs you created in the previous step.
1. [Optional] Set your pre-pass and post-pass contact duration seconds. This is used to emit per-contact events prior-to and after the contact, respectively. See [Automate AWS Ground Station with Events](monitoring.automating-events.md) for more information.
1. [Optional] Set your *telemetrySinkConfigArn* to enable telemetry during contacts. This allows you to receive near real-time telemetry directly in your account for monitoring and analysis. See [Work with telemetry](telemetry.md) for more information.
1. [Optional] You can associate Tags to your mission profile. These can be used to help programmatically differentiate your mission profiles.
You can reference the [Example mission profile configurations](examples.md), to see just some of the potential configurations.
# Understand next steps
Now that you have an onboarded satellite and a valid mission profile, you are ready to schedule contacts and communicate with your satellite with AWS Ground Station.
You can schedule a contact in one of the following ways:
+ The [AWS Ground Station console](https://console.aws.amazon.com/groundstation).
+ The AWS CLI [ reserve-contact](https://docs.aws.amazon.com/cli/latest/reference/groundstation/reserve-contact.html) command.
+ The AWS SDK. [ ReserveContact](https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ReserveContact.html) API.
For information about how AWS Ground Station tracks the trajectory of your satellite and how that information is used, please reference [Understand how AWS Ground Station uses ephemerides](ephemeris.md).
AWS Ground Station maintains a number of preconfigured CloudFormation templates to make getting started with the service easier. See [Example mission profile configurations](examples.md) for examples of how AWS Ground Station can be used.
Processing the digital intermediate frequency data, or the demodulated and decoded data provided to you from AWS Ground Station will depend on your specific use case. The following blog posts can help you to understand some of the options available to you:
+ [Automated Earth observation using AWS Ground Station Amazon S3 data delivery](https://aws.amazon.com/blogs/publicsector/automated-earth-observation-aws-ground-station-amazon-s3-data-delivery) (and it's associated GitHub repository [awslabs/aws-groundstation-eos-pipeline](https://github.com/awslabs/aws-groundstation-eos-pipeline))
+ [Virtualizing the satellite ground segment with AWS](https://aws.amazon.com/blogs/publicsector/virtualizing-satellite-ground-segment-aws/)
+ [Earth observation using AWS Ground Station: A how to guide](https://aws.amazon.com/blogs/publicsector/earth-observation-using-aws-ground-station/)
+ [Building high-throughput satellite data downlink architectures with AWS Ground Station WideBand DigIF and Amphinicy Blink SDR](https://aws.amazon.com/blogs/publicsector/building-high-throughput-satellite-data-downlink-architectures-aws-ground-station-wideband-digif-amphinicy-blink-sdr/) (and it's associated GitHub repository [aws-samples/aws-groundstation-wbdigif-snpp](https://github.com/aws-samples/aws-groundstation-wbdigif-snpp))