Applied Technology 🛰️ Amazon Leo: How AWS Brought Amazon's Project Kuiper to Market
Amazon Leo is an innovative new internet backbone. For enterprise, builders, and consumers, Leo delivers low-latency, high-bandwidth global connectivity 🌐, leveraging familiar AWS building blocks scaled to constellation level. re:Invent 2025 showcased how AWS infrastructure moved Project Kuiper from concept to the reality that is Amazon Leo
Series: Amazon Leo Private Satellite Networking (3 articles)
- 2Applied Technology 🛰️ Amazon Leo: How AWS Brought Amazon's Project Kuiper to Market This article
From Terminals to Constellation
At re:Invent, Amazon publicly showed the Amazon Leo enterprise terminal for the first time—a glimpse of how customers will actually touch the service. I'd heard that the terminals were designed to be designed to withstand explosions for offshore oil rig use cases, and asked if I could touch. The booth team looked at my #AWSHero bling, thought about how much I knew about private satellite communications, paused and said "uhhh no. we were told to be very careful with this." But while we chatted, behind them a tall gentleman was busy talking to a colleague about Kubernetes clusters and used what he thought was a table as something to lounge against, while his wife put her iced coffee on top. The Amazon EKS fan squad moved on, clueless they had just encountered an exclusive unveiling, the Leo team none the wiser their prize possession had just been assaulted, and myself confident that this really was a ruggedized connectivity device.
Here's my notes on how Amazon Leo leveraged AWS to simulate and launch their space constellation of satellites and enable private connectivity globally.
Amazon Leo Enterprise-Class Terminal & Booth at re:Invent 2025
Amazon Leo supports multiple classes of customer terminals:
- Small form factor terminal
- Up to 100 Mbps down / 40 Mbps up
- ~60W power draw
- Scale-focused terminal
- Up to 400 Mbps down / 100 Mbps up
- ~90W power draw
- Enterprise-focused terminal
- Up to 1 Gbps down / 400 Mbps up
- ~225W power draw
Conceptually, these map to three tiers:
- Nano – ~100 Mbps down, suited for music streaming and general consumer use.
- Pro – ~400 Mbps down, focused on heavier data download scenarios.
- Ultra – ~1 Gbps down, ~400 Mbps up, aimed at live media and high-throughput enterprise workloads.
Terminals are phased-array antennas with custom silicon computer chips present at both ground station and satellite (a baseband chip code named “Prometheus”) for sophisticated beamforming and signal processing, engineered to survive harsh conditions and auto-align to satellites.
Above them, Amazon will operate a constellation of 3,000+ LEO satellites at roughly 590–630 km altitude. Satellites are interconnected with optical inter-satellite links (OISL)—laser links capable of very high data rates over long distances—creating an in-space mesh network that keeps data in orbit as long as it’s efficient to do so.
Network Connections: Space Meets Fiber
The physical network combines radio, fiber, and AWS POPs into a single Space Backbone.
On the radio side:
- Satellite downlink bands:
- 17.7–18.6 GHz
- 18.8–19.4 GHz
- 19.7–20.2 GHz
- Gateway uplink band:
- 27.5–30.0 GHz
On the ground side, a typical flow looks like:
Ground Gateway → Antenna → Ground Gateway → POP → TT&C
- Ground Gateways: Large antenna sites that send/receive data to the satellites.
- POP (Point of Presence): Where Leo’s network meets AWS’s terrestrial backbone.
- TT&C (Telemetry, Tracking & Command): Dedicated sites for control-plane communications.
- All ground connections are carried over fiber.
The network also uses a grid of 1.6 million “planning cells” (polygons) on which satellites can beamform, with hundreds of beams per satellite and thousands of customers in play. Optimization across this grid must account for geography, weather, usage patterns, and outages—while still meeting strict service commitments.
Built on AWS Global Infrastructure
Leo rides on the same global infrastructure that powers NFL Next Gen Stats, streaming platforms, and critical enterprise workloads:
- 36 Regions
- 114 Availability Zones
- 700+ CloudFront POPs
- 135+ AWS Direct Connect locations
- 6+ million kilometers of fiber optic cabling
This backbone delivers resilience, low latency, and high throughput. At “Amazon scale,” AWS already handles:
- 524 million commands to 7,000+ robots on Outposts
- 87,000 Trainium & Inferentia chips
- 1.7 trillion AWS Lambda invocations
- 626 billion SageMaker inference requests
- 20.3 trillion EBS I/O requests
- 18.4 million ECS tasks launched
- 1 trillion API Gateway requests
- 1.5 quadrillion ElastiCache requests
- 8.9 trillion GuardDuty log events per hour
- 151 million requests per second on DynamoDB
- 807 million Kinesis records per second
- 3 trillion CloudFront HTTP requests
- 2.5 trillion CloudTrail events
- On Aurora: 500 billion transactions, 4,071 TB of data stored, 999 TB transferred
Leo is designed to operate at this same magnitude—just with satellites, ground stations, and terminals in the mix.
Andy Huntwork, Senior Principal Engineer on Amazon LEO at reInvent 2025
Hardware, Software, and Constellation-Scale Simulation
Before you fly a constellation, you simulate it.
Inside Amazon’s labs and cloud environments, Leo’s engineering toolchain looks surprisingly familiar:
- Linux boxes
- Commodity switches
- CAN bus
- FPGAs
Engineers iterate on hardware and software using:
- Emulated environments for sensors, actuators, and body mechanics
- Hundreds of billions of simulation permutations
- Millisecond system communication latencies
- Nanosecond-level jitter requirements for beam formation
Serverless Workflow Orchestration with Step Functions
Massive, multi-step simulations—like Monte Carlo analyses of link reliability or ground-station handoff—are orchestrated with AWS Step Functions:
- Each simulation becomes a visual state machine:
Step Functions manages state, checkpoints, retries, and error handling. - Distributed Map:
- Iterates over enormous datasets in Amazon S3 (e.g., billions of constellation states).
- Scales out to 10,000 parallel child executions for constellation-scale experiments.
High-Performance Compute Engines
The actual simulation workloads are distributed across:
- Containerized workloads on:
- AWS Fargate
- Amazon ECS
- Amazon EKS
- AWS Graviton-based EC2:
- Used for microservices and HPC workloads
- Provides better price-performance and energy efficiency
Hardware Emulation with FPGAs
For Hardware-in-the-Loop (HIL) testing and payload emulation:
- Field-Programmable Gate Arrays (FPGAs) implement custom digital designs for Leo’s networking functions.
- Amazon EC2 F2 FPGA instances:
- Efficiently process large volumes of satellite bandwidth.
- Implement waveforms like DVB-S2X and DVB-RCS2.
- Run digital signal processing (DSP) algorithms such as low-density parity check (LDPC) decoding.
What the Simulations Model
The simulation function is to provide a high-fidelity environment for:
- Constellation dynamics:
Orbits and constantly changing lines of sight for 3,000+ satellites. - Network protocol validation:
QoS algorithms, TCP/IP, and IPv6 stacks in virtualized/emulated networks. - Inter-satellite links (OISL):
Performance and handoffs for laser-based satellite-to-satellite connections.
Together, Step Functions, HPC compute, and FPGA acceleration let Amazon run, scale, and analyze thousands of scenarios to validate the Leo system before and during deployment.
The Amazon LEO team built a Serverless application for spinning up constellation simulations with API Gateway
Space IoT and Predictive State
Space systems live in a world of constant failure, low throughput, and limited data. You rarely get always-on links; instead, you deal with planned, orchestrated contacts and rely on predicted state between passes.
The architecture for orbital-state prediction looks something like:
- Data Ingestion and Processing
- Amazon Kinesis ingests real-time orbital updates from space assets.
- AWS Lambda processes each record—transforming data and applying business logic.
- Amazon DynamoDB stores session state, metadata, or intermediate results.
- Workflow Orchestration
- AWS Step Functions coordinates the full prediction pipeline:
- Data normalization
- Invocation of models
- Postprocessing and routing
- For heavyweight workloads:
- Step Functions launches Amazon EC2 instances for specialized or long-running compute that doesn’t fit in Lambda.
- AWS Step Functions coordinates the full prediction pipeline:
- Data Storage and Search
- Amazon S3:
- Stores prediction outputs, historical runs, and large artifacts.
- Amazon OpenSearch Service:
- Indexes results for search and operational dashboards.
- Amazon S3:
Key characteristics:
- Serverless first: Kinesis, Lambda, DynamoDB, and Step Functions minimize undifferentiated infrastructure.
- Workflow-driven: Step Functions ensures durable, observable execution.
- Real-time capable: Kinesis supports near real-time ingestion.
- Searchable outputs: OpenSearch makes predicted state immediately queryable.
Optimizing 1.6 Million Cells: ML + Telemetry
The “physical layer” optimization problem Leo faces is enormous:
- 1.6 million cells
- Hundreds of beams per satellite
- Thousands of customers
Constraints:
- Geography
- Weather
- Demand patterns
- Unplanned outages
The goal: uphold service commitments while recomputing allocations many times per second.
Optimization Stack
Leo’s optimization engine leans on several AWS services:
- Amazon SageMaker Studio:
Builds and deploys ML models to predict demand and optimize beam/cell assignments. - Amazon Timestream:
Time-series store for rapidly changing telemetry (signal strength, latency, throughput). - Amazon Managed Grafana:
Visualizes ML outputs and telemetry, helping engineers see the health of all cells at a glance. - AWS Lambda:
Reacts to events and telemetry changes with small, rapid decisions. - Amazon SNS:
Sends alerts or triggers additional automation when metrics cross thresholds. - Network Load Balancer:
Distributes traffic across ground stations and network endpoints for high availability.
Telemetry: Multi-Account, Real-Time, and Auditable
Operating Leo requires continuous insight into satellite and network health.
A typical telemetry data flow:
- Source: Antenna Ground Station
- An antenna array receives telemetry from Leo satellites.
- A Telemetry & Monitoring Service (e.g., on EC2) preprocesses and streams the raw data.
- Central Ingestion
- Data is published to a central Amazon Kinesis Data Stream.
- This central stream fans out to multiple AWS accounts.
- Processing & Analysis Account
- Kinesis Data Streams receive the feed.
- Path 1 – Real-time metrics:
- AWS Lambda extracts KPIs and aggregates metrics.
- Amazon CloudWatch stores and visualizes metrics and alarms.
- Path 2 – Log aggregation:
- Amazon Kinesis Data Firehose batches and transforms logs.
- Amazon S3 stores them for long-term archival.
- AWS Glue and Amazon Athena provide schema management and ad-hoc querying over S3.
- Security & Audit Account
- AWS CloudTrail logs all API activity for compliance and investigations.
- Amazon EventBridge:
- Ingests events from CloudWatch, CloudTrail, and other sources.
- Routes them (based on rules) to:
- Amazon SNS for human notifications
- AWS Lambda for automated remediation
This multi-account architecture keeps operations, analytics, and security well-isolated while preserving a unified telemetry backbone.
Security, Encryption, and Compliance
Leo’s design emphasizes multilayered security and compliance from terminal to cloud.
Encryption Model
- Application layer encryption:
Managed by Amazon Leo and/or the customer.
Ensures payloads are encrypted end-to-end. - Network layer encryption between antenna and POP:
Protects radio and ground links in transit. - Direct Connect Layer 2 encryption:
- 256-bit AES in dedicated hardware.
- MACsec for hop-by-hop encryption across AWS’s backbone.
- Zero performance impact on throughput by design.
In practice, if someone intercepted the over-the-air signal, they would see:
- TLS headers
- Fully encapsulated, encrypted data
- Random-looking, unencrypted bits protected by MACsec
They would not see the underlying customer data.
Certifications and Services
Leo leans on AWS’s compliance posture:
- ISO/IEC 27001:2022
- ISO/IEC 22301:2019
And on core security services:
- AWS Direct Connect
- AWS Key Management Service (KMS)
- AWS Identity and Access Management (IAM)
- AWS Nitro Enclaves for isolated processing of sensitive data
Identity and Temporary Delegation (IAM + STS)
To securely operate Leo and integrate with customer environments, Amazon uses IAM roles and AWS Security Token Service (STS):
- IAM Roles:
Define a permission layer for Leo-related actions across AWS accounts.
Let services assume fine-grained, time-bounded permissions instead of using long-lived credentials. - STS Temporary Credentials:
Short-lived (minutes to hours).
Not stored with users or applications; generated on demand.
Automatically become unusable after expiration.
Benefits:- No need to embed long-term access keys in terminals or services.
- Enable access to AWS resources without creating permanent identities for every actor.
- Form the basis of roles and identity federation across organizations.
This model supports least-privilege, revocable access patterns crucial to operating a global satellite network securely.
A new temporary delegation process from IAM allows temporary security credentials and integraiton with AWS Identity and Access Management
From Experimental Idea to Operating Service
Bringing Project Kuiper to market meant more than launching satellites. It required:
- Designing terminals and beams for a 1.6M-cell global grid.
- Modeling a constellation before it flew, using Step Functions, Graviton, and FPGAs.
- Leveraging the AWS global backbone and its multi-million-kilometer fiber network.
- Building telemetry, optimization, and predictive state architectures on Kinesis, Timestream, SageMaker, Grafana, and more.
- Hardening the system with end-to-end encryption, ISO certifications, and IAM+STS.
Leo is what happens when a mature cloud platform and its sister product company turn their tools inward to build a new kind of network—one that now becomes a building block for everyone else.
Questions? I always love talking satellite connectivity and Amazon Leo! Hit me up in the comment section below or on LinkedIn
Series: Amazon Leo Private Satellite Networking (3 articles)
- 2Applied Technology 🛰️ Amazon Leo: How AWS Brought Amazon's Project Kuiper to Market This article
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article