Amazon FreeRTOS
User Guide

Amazon FreeRTOS Over-the-Air Updates

The Amazon FreeRTOS Over-the-Air Update service enables you to:

  • Digitally sign and encrypt firmware before deployment.

  • Securely deploy new firmware images to a single device, a group of devices, or your entire fleet.

  • Deploy firmware to devices as they are added to groups, reset, or reprovisioned.

  • Verify the authenticity and integrity of new firmware after it's deployed to devices.

  • Monitor the progress of a deployment.

  • Debug a failed deployment.

The Amazon FreeRTOS OTA Update service includes the following components:

OTA Manager Service

The OTA Manager service enables users to create and manage deployments of firmware images on one or more devices or MCUs. The OTA Manager Service uses the AWS IoT Jobs service to schedule deployments.

AWS IoT Jobs Service

The AWS IoT Jobs service is a cloud-based managed service for scheduling, orchestration, notification, and status reporting of OTA updates and other remote operations on distributed fleets of devices. To update a device, you create an OTA update job. The job specifies which devices should perform the update and where to find the firmware image, among other things. When a job is deployed to a device, a job execution is created. The job execution represents a single device applying the update. For more information, see AWS IoT Jobs.

Streaming Service

The Streaming service delivers new firmware images over MQTT to your devices. The Streaming service breaks up the firmware image into chunks and delivers each chunk as an MQTT message to the devices that are being updated. The service can redeliver blocks or a full image on request.

Code Signing for Amazon FreeRTOS Service

Code Signing for Amazon FreeRTOS is a managed AWS service that enables you to digitally sign code that you create for any AWS IoT device that is supported by Amazon Web Services (AWS). Code Signing is integrated with Amazon FreeRTOS and AWS Certificate Manager (ACM). Amazon FreeRTOS customers can use Code Signing for Amazon FreeRTOS to sign a firmware image before publishing it to a MCU device. You can use ACM to import a third-party code signing certificate that you can use during the signing process.

OTA Library and Agent

The OTA library allows the device developer to logically separate the application from the OTA process. The OTA library contains an OTA agent that is executed as an RTOS task.

The OTA agent is responsible for:

  • Downloading a new firmware image from the cloud.

  • Validating the firmware image.

  • Handling interruptions during the download.

  • Managing updates that are separated into multiple sections.

By automating firmware signature verification, the OTA library makes it easy for you to protect the integrity of your devices. By defining a portable abstraction layer (PAL), the OTA library minimizes the burden for onboarding new hardware to OTA-enabled applications.

OTA is supported in the following regions:

  • us-east-1 / US East (N. Virginia)

  • us-east-2 / US East (Ohio)

  • us-west-2 / US West (Oregon)

  • eu-west-1 / EU (Ireland)

  • eu-central-1 / EU (Frankfurt)

  • eu-west-2 / EU (London)

  • ap-northeast-1 / Asia Pacific (Tokyo)

  • ap-southeast-2 / Asia Pacific (Sydney)

The region you are working in is displayed in the upper-right corner of the AWS Management Console. You can use the drop-down list to change the region. Before you create an OTA update, make sure you are working in one of these supported regions.


For the Amazon FreeRTOS OTA agent to commit a firmware upgrade, the firmware image must include the OTA agent library. The firmware version must be more recent than the currently installed firmware.

Devices communicate with the Amazon FreeRTOS OTA Update service using MQTT messages. Each device must subscribe to the appropriate topics to receive messages. MQTT messages are used to notify devices that an update is available, report the status of an update, and to stream the firmware updates. Each device has its own set of MQTT topics. The OTA demo application included with the OTA library subscribes to the required MQTT topics and contains the logic required to respond to, download and install an OTA update, and restart a device after it has downloaded a firmware update.