{"templateId":"markdown","versions":[{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/deployment/integrate-kms/mpc/aws-deployment","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/deployment/integrate-kms/mpc/aws-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/integrate-kms/mpc/aws-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/integrate-kms/mpc/aws-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/integrate-kms/mpc/aws-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/integrate-kms/mpc/aws-deployment","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"MPC deployment on AWS","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"mpc-deployment-on-aws","__idx":0},"children":["MPC deployment on AWS"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide covers deploying customer MPC nodes (Node 2 and Node 3) to AWS using the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC Deployer"]}," tool."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Prerequisites:"]}," Review the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/overview"},"children":["MPC overview"]}," to understand the architecture, shared responsibility model, and node ownership before proceeding."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The MPC Deployer automates the deployment of customer MPC nodes to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AWS Nitro Enclaves"]},", providing hardware-based isolation for key material."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-gets-deployed","__idx":2},"children":["What gets deployed"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart TB\n subgraph aws[\"AWS Account (Customer)\"]\n subgraph vpc[\"VPC\"]\n subgraph pub1[\"Public Subnet 1\"]\n nat1[\"NAT Gateway 1\"]\n end\n subgraph pub2[\"Public Subnet 2\"]\n nat2[\"NAT Gateway 2\"]\n end\n subgraph priv1[\"Private Subnet 1 (AZ1)\"]\n ec2_1[\"EC2 Nitro Instance
MPC Node 2\"]\n end\n subgraph priv2[\"Private Subnet 2 (AZ2)\"]\n ec2_2[\"EC2 Nitro Instance
MPC Node 3\"]\n end\n end\n igw[\"Internet Gateway\"]\n s3[\"S3 Bucket
Enclave Config\"]\n secrets[\"Secrets Manager
Keys & Config\"]\n cw[\"CloudWatch
Logs\"]\n end\n\n igw --> nat1\n igw --> nat2\n nat1 --> ec2_1\n nat2 --> ec2_2\n ec2_1 --> s3\n ec2_2 --> s3\n ec2_1 --> secrets\n ec2_2 --> secrets\n ec2_1 --> cw\n ec2_2 --> cw\n\n style aws fill:#fff3e0,stroke:#ef6c00\n style vpc fill:#e3f2fd,stroke:#1565c0\n style ec2_1 fill:#e8f5e9,stroke:#2e7d32\n style ec2_2 fill:#e8f5e9,stroke:#2e7d32\n","diagramHtml":"

AWS Account (Customer)

VPC

Private Subnet 2 (AZ2)

Private Subnet 1 (AZ1)

Public Subnet 2

Public Subnet 1

EC2 Nitro Instance
MPC Node 3

Internet Gateway

NAT Gateway 1

NAT Gateway 2

EC2 Nitro Instance
MPC Node 2

S3 Bucket
Enclave Config

Secrets Manager
Keys & Config

CloudWatch
Logs

","diagramHtmlDark":"

AWS Account (Customer)

VPC

Private Subnet 2 (AZ2)

Private Subnet 1 (AZ1)

Public Subnet 2

Public Subnet 1

EC2 Nitro Instance
MPC Node 3

Internet Gateway

NAT Gateway 1

NAT Gateway 2

EC2 Nitro Instance
MPC Node 2

S3 Bucket
Enclave Config

Secrets Manager
Keys & Config

CloudWatch
Logs

"},"children":["flowchart TB\n subgraph aws[\"AWS Account (Customer)\"]\n subgraph vpc[\"VPC\"]\n subgraph pub1[\"Public Subnet 1\"]\n nat1[\"NAT Gateway 1\"]\n end\n subgraph pub2[\"Public Subnet 2\"]\n nat2[\"NAT Gateway 2\"]\n end\n subgraph priv1[\"Private Subnet 1 (AZ1)\"]\n ec2_1[\"EC2 Nitro Instance
MPC Node 2\"]\n end\n subgraph priv2[\"Private Subnet 2 (AZ2)\"]\n ec2_2[\"EC2 Nitro Instance
MPC Node 3\"]\n end\n end\n igw[\"Internet Gateway\"]\n s3[\"S3 Bucket
Enclave Config\"]\n secrets[\"Secrets Manager
Keys & Config\"]\n cw[\"CloudWatch
Logs\"]\n end\n\n igw --> nat1\n igw --> nat2\n nat1 --> ec2_1\n nat2 --> ec2_2\n ec2_1 --> s3\n ec2_2 --> s3\n ec2_1 --> secrets\n ec2_2 --> secrets\n ec2_1 --> cw\n ec2_2 --> cw\n\n style aws fill:#fff3e0,stroke:#ef6c00\n style vpc fill:#e3f2fd,stroke:#1565c0\n style ec2_1 fill:#e8f5e9,stroke:#2e7d32\n style ec2_2 fill:#e8f5e9,stroke:#2e7d32\n"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Existing VPC support:"]}," The deployer supports a mode where networking resources (VPC, subnets, NAT gateways, etc.) are not created. Use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}," flag if your organization manages networking centrally."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"aws-resources-created","__idx":3},"children":["AWS resources created"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Resource"},"children":["Resource"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Count"},"children":["Count"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Notes"},"children":["Notes"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["VPC"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network isolation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional - use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}," to skip"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Public Subnets"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["NAT gateway hosting"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional - not created with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Private Subnets"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC node hosting (one per AZ)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional - not created with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Internet Gateway"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Outbound internet access"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional - not created with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["NAT Gateways"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Outbound access for private subnets"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional - not created with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Route Tables"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["4"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network routing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional - not created with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["EC2 Nitro Instances"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC Node 2 and Node 3"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Security Groups"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network access control"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["S3 Bucket"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enclave configuration storage"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secrets Manager"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keys and configuration storage"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CloudWatch Log Groups"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Centralized logging"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["IAM Roles"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["EC2 instance permissions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":4},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"aws-requirements","__idx":5},"children":["AWS requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Account & permissions:"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["AWS account with administrative access"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permissions allowing the deployer tool to create resources in the AWS account"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Credentials (one of):"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"# Option 1: Environment variables\nexport AWS_ACCESS_KEY_ID=\"your-access-key\"\nexport AWS_SECRET_ACCESS_KEY=\"your-secret-key\"\nexport AWS_DEFAULT_REGION=\"us-east-1\"\n\n# Option 2: AWS credentials file (~/.aws/credentials)\n[default]\naws_access_key_id = your-access-key\naws_secret_access_key = your-secret-key\nregion = us-east-1\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"execution-requirements","__idx":6},"children":["Execution requirements"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Docker"]},": Docker Desktop or Docker Engine installed and running"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC Deployer Image"]},": Access to Ripple's Docker registry"]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Important:"]}," Contact your Ripple representative to obtain the official MPC Deployer Docker image and registry credentials. Do not use locally-built images in production."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"from-ripple","__idx":7},"children":["From Ripple"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before deployment, Ripple will provide:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Item"},"children":["Item"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC Deployer Image"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Official Docker image tag and registry credentials"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tenant Alias"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your organization identifier"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tenant Instance Code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Environment identifier (e.g., prod, uat)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Docker Registry Credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Access to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["metaco.azurecr.io"]}," (where MPC core component images are stored)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Decryption Server URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enclave decryption service endpoint"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OpenTelemetry Endpoint"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observability service configuration"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"deployment-process","__idx":8},"children":["Deployment process"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The deployment follows a coordinated process between you and Ripple:"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant C as Customer\n participant T as MPC Deployer Tool\n participant AWS as AWS Account\n participant R as Ripple\n\n Note over C,R: Phase 1: Key Generation\n C->>T: Run --keygen mode\n T->>AWS: Store keys in Secrets Manager\n T->>C: Output Node 2 & 3 Peer IDs\n C->>R: Share Peer IDs\n\n Note over C,R: Phase 2: Ripple Setup\n R->>R: Configure Nodes 0 & 1\n R->>R: Configure Relay Server\n R->>C: Provide Ripple config\n\n Note over C,R: Phase 3: Deployment\n C->>T: Run deployment mode\n T->>AWS: Provision infrastructure\n T->>AWS: Deploy EC2 Nitro instances\n T->>C: Deployment complete\n\n Note over C,R: Phase 4: Verification\n C->>R: Confirm connectivity\n R->>C: Run cluster health check\n","diagramHtml":"RippleAWS AccountMPC Deployer ToolCustomerRippleAWS AccountMPC Deployer ToolCustomerPhase 1: Key GenerationPhase 2: Ripple SetupPhase 3: DeploymentPhase 4: VerificationRun --keygen modeStore keys in Secrets ManagerOutput Node 2 & 3 Peer IDsShare Peer IDsConfigure Nodes 0 & 1Configure Relay ServerProvide Ripple configRun deployment modeProvision infrastructureDeploy EC2 Nitro instancesDeployment completeConfirm connectivityRun cluster health check","diagramHtmlDark":"RippleAWS AccountMPC Deployer ToolCustomerRippleAWS AccountMPC Deployer ToolCustomerPhase 1: Key GenerationPhase 2: Ripple SetupPhase 3: DeploymentPhase 4: VerificationRun --keygen modeStore keys in Secrets ManagerOutput Node 2 & 3 Peer IDsShare Peer IDsConfigure Nodes 0 & 1Configure Relay ServerProvide Ripple configRun deployment modeProvision infrastructureDeploy EC2 Nitro instancesDeployment completeConfirm connectivityRun cluster health check"},"children":["sequenceDiagram\n participant C as Customer\n participant T as MPC Deployer Tool\n participant AWS as AWS Account\n participant R as Ripple\n\n Note over C,R: Phase 1: Key Generation\n C->>T: Run --keygen mode\n T->>AWS: Store keys in Secrets Manager\n T->>C: Output Node 2 & 3 Peer IDs\n C->>R: Share Peer IDs\n\n Note over C,R: Phase 2: Ripple Setup\n R->>R: Configure Nodes 0 & 1\n R->>R: Configure Relay Server\n R->>C: Provide Ripple config\n\n Note over C,R: Phase 3: Deployment\n C->>T: Run deployment mode\n T->>AWS: Provision infrastructure\n T->>AWS: Deploy EC2 Nitro instances\n T->>C: Deployment complete\n\n Note over C,R: Phase 4: Verification\n C->>R: Confirm connectivity\n R->>C: Run cluster health check\n"]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-generate-node-keys","__idx":9},"children":["Step 1: Generate node keys"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Generate cryptographic keys for your MPC nodes (Node 2 and Node 3):"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n -e AWS_ACCESS_KEY_ID \\\n -e AWS_SECRET_ACCESS_KEY \\\n -e AWS_DEFAULT_REGION \\\n -v $(pwd)/output:/app/output \\\n /mpc-deployer: \\\n --keygen --output /app/output\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The tool will prompt for:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Region"]},": Primary AWS region (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["us-east-1"]},")"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Secondary region"]},": DR region (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["us-west-2"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tenant alias"]},": Your organization identifier."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tenant Instance Code"]},": Environment code"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Output:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"šŸŽ‰ Key material successfully generated and stored in AWS Secrets Manager.\nšŸ”‘ Node 2 Public Key (Peer ID): 12D3KooWBhMevWJT...\nšŸ”‘ Node 3 Public Key (Peer ID): 12D3KooWCdEfGhIj...\n"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Share with Ripple:"]}," Send the Node 2 and Node 3 Peer IDs to your Ripple representative. These are public identifiers and are safe to share."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-wait-for-ripple-configuration","__idx":10},"children":["Step 2: Wait for Ripple configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple will configure their infrastructure and provide you with:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Configuration"},"children":["Configuration"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Example"},"children":["Example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Relay Host"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["relay.mpc.ripple.com"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Relay Port"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["6000"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Relay Public Key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["12D3KooW..."]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Node 0 Public Key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["12D3KooW..."]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Node 1 Public Key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["12D3KooW..."]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC Docker Image"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["metaco.azurecr.io/custody/mpc-core:1.3.12"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-deploy-mpc-nodes","__idx":11},"children":["Step 3: Deploy MPC nodes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once you receive configuration from Ripple, deploy the infrastructure:"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"non-interactive-deployment-recommended","__idx":12},"children":["Non-interactive deployment (recommended)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For production deployments, use environment variables with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--non-interactive"]}," flag:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"# Create .env file with configuration\ncat > .env << EOF\nREGION=us-east-1\nSECONDARY_REGION=us-west-2\nTENANT_ALIAS=your-tenant\nTENANT_INSTANCE_CODE=prod\n\nMPC_DOCKER_IMAGE=metaco.azurecr.io/custody/mpc-core:1.3.12\nMPC_DOCKER_REGISTRY_USERNAME=your-username\nMPC_DOCKER_REGISTRY_PASSWORD=your-password\n\nMPC_RELAY_HOST=relay.mpc.ripple.com\nMPC_RELAY_PORT=6000\nMPC_RELAY_PUBLIC_KEY=12D3KooW...\nMPC_NODE0_PUBLIC_KEY=12D3KooW...\nMPC_NODE1_PUBLIC_KEY=12D3KooW...\n\nOTEL_HTTP_ENDPOINT=https://your-otel-endpoint\nOTEL_HTTP_USER=your-username\nOTEL_HTTP_PASSWORD=your-password\n\nENCLAVE_DECRYPTION_SERVER_URL=https://decrypter.metaco.services\nEOF\n\n# Run deployment\ndocker run --rm -it \\\n --env-file .env \\\n -e AWS_ACCESS_KEY_ID \\\n -e AWS_SECRET_ACCESS_KEY \\\n -v $(pwd)/output:/app/output \\\n -v $(pwd)/.terraform-state:/terraform-state \\\n /mpc-deployer: \\\n --output /app/output --non-interactive\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"interactive-deployment-fallback","__idx":13},"children":["Interactive deployment (fallback)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you prefer to enter configuration interactively:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n -e AWS_ACCESS_KEY_ID \\\n -e AWS_SECRET_ACCESS_KEY \\\n -e AWS_DEFAULT_REGION \\\n -v $(pwd)/output:/app/output \\\n -v $(pwd)/.terraform-state:/terraform-state \\\n /mpc-deployer: \\\n --output /app/output\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The tool will prompt for all required configuration. Previously stored values (from key generation) will be pre-populated from AWS Secrets Manager."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"deployment-into-existing-vpc","__idx":14},"children":["Deployment into existing VPC"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you have an existing VPC, use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}," flag:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n -e AWS_ACCESS_KEY_ID \\\n -e AWS_SECRET_ACCESS_KEY \\\n -e AWS_DEFAULT_REGION \\\n -v $(pwd)/output:/app/output \\\n -v $(pwd)/.terraform-state:/terraform-state \\\n /mpc-deployer: \\\n --output /app/output --no-create-vpc\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You will be prompted for:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["VPC ID"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vpc-0123456789abcdef0"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Private Subnet 1 ID"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["subnet-0123456789abcdef0"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Private Subnet 2 ID"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["subnet-0123456789abcdef1"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Both subnets must be private and in separate Availability Zones. MPC nodes are outbound-only ā€” each node dials the relay server and nothing ever connects to them ā€” so a public subnet adds internet-reachable attack surface with no benefit."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Egress is your responsibility in this mode."]}," Each subnet needs a default route to a NAT gateway or corporate egress path, reaching the destinations you configure above. Without one, provisioning succeeds and the nodes then fail to start."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-verify-deployment","__idx":15},"children":["Step 4: Verify deployment"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After deployment completes, verify the infrastructure:"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"check-ec2-instances","__idx":16},"children":["Check EC2 instances"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Verify that the Nitro Enclave instances are running and have the correct instance type:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"aws ec2 describe-instances \\\n --filters \"Name=tag:Type,Values=nitro-enclave\" \\\n --query 'Reservations[].Instances[].{ID:InstanceId,State:State.Name,Type:InstanceType}'\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["What to check:"]}," Confirm both instances show ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["State: running"]}," and are using a Nitro-compatible instance type (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["m5.xlarge"]}," or larger)."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"check-cloudwatch-logs","__idx":17},"children":["Check CloudWatch logs"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Verify that log groups exist and contain enclave boot logs:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"aws logs describe-log-groups \\\n --log-group-name-prefix \"-\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["What to check:"]}," Look for log entries indicating the enclave has successfully booted and connected to the relay server."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"verify-secrets-manager","__idx":18},"children":["Verify Secrets Manager"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Confirm that secrets were created for your deployment:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"aws secretsmanager list-secrets \\\n --filter Key=name,Values=\"-\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["What to check:"]}," This command lists secret names only and does not reveal key material. Verify that secrets for Node 2 and Node 3 exist."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"command-reference","__idx":19},"children":["Command reference"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Flag"},"children":["Flag"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Default"},"children":["Default"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--output"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Output directory for logs and generated files"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["./output/"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--keygen"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Generate key material for customer nodes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use existing VPC (prompts for VPC/subnet IDs)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--non-interactive"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Disable interactive prompts (recommended for production)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--dry-run"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Simulate deployment without making changes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":20},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"common-issues","__idx":21},"children":["Common issues"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Issue"},"children":["Issue"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["AWS credentials error"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Invalid or expired credentials"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Refresh credentials, verify IAM permissions"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["VPC quota exceeded"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Account VPC limit reached"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Request limit increase or use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["EC2 instance launch failed"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Nitro instance not available in AZ"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Try different region or instance type"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Nodes fail to start with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Supplied subnet has no egress path"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add a default route to a NAT gateway or corporate egress path"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Docker registry auth failed"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Invalid registry credentials"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify credentials with Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secrets Manager access denied"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing IAM permissions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify your Secrets Manager permissions"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"log-files","__idx":22},"children":["Log files"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All operations are logged to the output directory:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Log File"},"children":["Log File"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Content"},"children":["Content"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["output.log"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Main application logs"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cdktf.log"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Infrastructure provisioning logs"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"getting-help","__idx":23},"children":["Getting help"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you encounter issues:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Check log files in the output directory"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify AWS credentials and permissions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Contact your Ripple representative with log files"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":24},"children":["Next steps"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After successful deployment, contact your Ripple representative to:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify connectivity"]}," between your nodes and Ripple nodes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Complete cluster configuration"]}," and run health checks"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Test key generation"]}," using the DKG process"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/backups"},"children":["MPC backups"]}]}," for encrypted shard backups with verifiable encryption"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/production-best-practices"},"children":["Production best practices"]}]}," for namespace segmentation, HA, and monitoring"]}]}]},"headings":[{"value":"MPC deployment on AWS","id":"mpc-deployment-on-aws","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"What gets deployed","id":"what-gets-deployed","depth":3},{"value":"AWS resources created","id":"aws-resources-created","depth":3},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"AWS requirements","id":"aws-requirements","depth":3},{"value":"Execution requirements","id":"execution-requirements","depth":3},{"value":"From Ripple","id":"from-ripple","depth":3},{"value":"Deployment process","id":"deployment-process","depth":2},{"value":"Step 1: Generate node keys","id":"step-1-generate-node-keys","depth":2},{"value":"Step 2: Wait for Ripple configuration","id":"step-2-wait-for-ripple-configuration","depth":2},{"value":"Step 3: Deploy MPC nodes","id":"step-3-deploy-mpc-nodes","depth":2},{"value":"Non-interactive deployment (recommended)","id":"non-interactive-deployment-recommended","depth":3},{"value":"Interactive deployment (fallback)","id":"interactive-deployment-fallback","depth":3},{"value":"Deployment into existing VPC","id":"deployment-into-existing-vpc","depth":3},{"value":"Step 4: Verify deployment","id":"step-4-verify-deployment","depth":2},{"value":"Check EC2 instances","id":"check-ec2-instances","depth":3},{"value":"Check CloudWatch logs","id":"check-cloudwatch-logs","depth":3},{"value":"Verify Secrets Manager","id":"verify-secrets-manager","depth":3},{"value":"Command reference","id":"command-reference","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Common issues","id":"common-issues","depth":3},{"value":"Log files","id":"log-files","depth":3},{"value":"Getting help","id":"getting-help","depth":3},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"MPC deployment on AWS"}},"lastModified":"2026-08-04T20:25:11.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/deployment/integrate-kms/mpc/aws-deployment","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}