{"templateId":"markdown","versions":[{"version":"v1.41","label":"v1.41 STS","link":"/products/custody/deployment/integrate-kms/mpc/azure-deployment","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/v1.40/deployment/integrate-kms/mpc/azure-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/integrate-kms/mpc/azure-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/integrate-kms/mpc/azure-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/integrate-kms/mpc/azure-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/integrate-kms/mpc/azure-deployment","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"MPC deployment on Azure","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"mpc-deployment-on-azure","__idx":0},"children":["MPC deployment on Azure"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide covers deploying customer MPC nodes (Node 2 and Node 3) to Microsoft Azure using the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC Deployer"]}," tool."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Prerequisites:"]}," Review the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/overview"},"children":["MPC overview"]}," to understand the architecture, shared responsibility model, and node ownership before proceeding."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The MPC Deployer automates the deployment of customer MPC nodes to Azure Confidential VMs, using AMD SEV-SNP based isolation for node execution and Azure Key Vault for node key material and deployment configuration."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-gets-deployed","__idx":2},"children":["What gets deployed"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart TB\n subgraph azure[\"Azure Subscription (Customer)\"]\n subgraph rg[\"Resource Group\"]\n subgraph vnet[\"Virtual Network\"]\n subgraph subnet1[\"Subnet 1\"]\n cvm1[\"Confidential VM
MPC Node 2\"]\n end\n subgraph subnet2[\"Subnet 2\"]\n cvm2[\"Confidential VM
MPC Node 3\"]\n end\n end\n kv[\"Deployer Key Vault
MPC Nodes Keys & Deployer config\"]\n hsmkv[\"Premium Key Vault
Contains the enclave contract wrapping key\"]\n mi[\"User-Assigned
Managed Identity\"]\n storage[\"Storage Account
Terraform State\"]\n logs[\"Boot diagnostics and Log Analytics Workspace (LAW)\"]\n end\n end\n\n cvm1 --> kv\n cvm2 --> kv\n cvm1 --> hsmkv\n cvm2 --> hsmkv\n mi --> kv\n mi --> hsmkv\n cvm1 --> logs\n cvm2 --> logs\n\n style azure fill:#e3f2fd,stroke:#1565c0\n style rg fill:#fafafa,stroke:#616161\n style vnet fill:#e8f5e9,stroke:#2e7d32\n style cvm1 fill:#fff3e0,stroke:#ef6c00\n style cvm2 fill:#fff3e0,stroke:#ef6c00\n style kv fill:#f3e5f5,stroke:#6a1b9a\n style hsmkv fill:#fce4ec,stroke:#ad1457\n","diagramHtml":"

Azure Subscription (Customer)

Resource Group

Virtual Network

Subnet 2

Subnet 1

Confidential VM
MPC Node 3

Confidential VM
MPC Node 2

Deployer Key Vault
MPC Nodes Keys & Deployer config

Premium Key Vault
Contains the enclave contract wrapping key

User-Assigned
Managed Identity

Boot diagnostics and Log Analytics Workspace (LAW)

Storage Account
Terraform State

","diagramHtmlDark":"

Azure Subscription (Customer)

Resource Group

Virtual Network

Subnet 2

Subnet 1

Confidential VM
MPC Node 3

Confidential VM
MPC Node 2

Deployer Key Vault
MPC Nodes Keys & Deployer config

Premium Key Vault
Contains the enclave contract wrapping key

User-Assigned
Managed Identity

Boot diagnostics and Log Analytics Workspace (LAW)

Storage Account
Terraform State

"},"children":["flowchart TB\n subgraph azure[\"Azure Subscription (Customer)\"]\n subgraph rg[\"Resource Group\"]\n subgraph vnet[\"Virtual Network\"]\n subgraph subnet1[\"Subnet 1\"]\n cvm1[\"Confidential VM
MPC Node 2\"]\n end\n subgraph subnet2[\"Subnet 2\"]\n cvm2[\"Confidential VM
MPC Node 3\"]\n end\n end\n kv[\"Deployer Key Vault
MPC Nodes Keys & Deployer config\"]\n hsmkv[\"Premium Key Vault
Contains the enclave contract wrapping key\"]\n mi[\"User-Assigned
Managed Identity\"]\n storage[\"Storage Account
Terraform State\"]\n logs[\"Boot diagnostics and Log Analytics Workspace (LAW)\"]\n end\n end\n\n cvm1 --> kv\n cvm2 --> kv\n cvm1 --> hsmkv\n cvm2 --> hsmkv\n mi --> kv\n mi --> hsmkv\n cvm1 --> logs\n cvm2 --> logs\n\n style azure fill:#e3f2fd,stroke:#1565c0\n style rg fill:#fafafa,stroke:#616161\n style vnet fill:#e8f5e9,stroke:#2e7d32\n style cvm1 fill:#fff3e0,stroke:#ef6c00\n style cvm2 fill:#fff3e0,stroke:#ef6c00\n style kv fill:#f3e5f5,stroke:#6a1b9a\n style hsmkv fill:#fce4ec,stroke:#ad1457\n"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Existing VNet support:"]}," The deployer supports a mode where networking resources are not created. Use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}," flag if your organization manages Azure networking centrally."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"azure-resources","__idx":3},"children":["Azure resources"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"pre-provisioned-resources","__idx":4},"children":["Pre-provisioned resources"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure deployments require several resources to exist before you run the deployer:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Resource"},"children":["Resource"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Notes"},"children":["Notes"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Resource group"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Deployment boundary for Azure resources"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Standard Key Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Stores MPC Nodes Keys & Deployer config"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must use RBAC authorization"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Premium Key Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Holds the enclave contract wrapping key"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must contain an RSA-4096 HSM-backed key"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User-assigned managed identity"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Allows Confidential VMs to access Key Vault resources"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must be created before deployment; grant access yourself or allow the deployer to assign Key Vault roles"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Existing VNet and subnets"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer-managed networking"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required only with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple can share utility scripts with you to ease the creation of these pre-provisioned resources within your Azure environment."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"resources-created-by-the-deployer","__idx":5},"children":["Resources created by the deployer"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Resource"},"children":["Resource"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Count"},"children":["Count"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Notes"},"children":["Notes"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Virtual Network"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network isolation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional - use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}," to skip"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Subnets"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC node hosting"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional - not created with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Confidential VMs"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC Node 2 and Node 3"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network interfaces"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["VM network attachment"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network security groups"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network access control"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Storage account/container"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Terraform state storage, contract token hashes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key Vault secrets/configuration"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Multiple"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keys, KEKs, and deployment configuration"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Boot diagnostics and Log Analytics Workspace (LAW)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Startup and node troubleshooting"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required or customer-configured"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":6},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"azure-requirements","__idx":7},"children":["Azure requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Subscription and permissions:"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Azure subscription dedicated to Ripple MPC Nodes deployment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permissions allowing the deployer tool to create resources in the Azure subscription."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confidential VM quota and supported VM SKUs in the selected Azure region."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Credentials:"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authenticate to Azure using the method approved by your organization. For service-principal based deployments, provide Azure credentials to the container using the environment variables expected by the deployer and the Terraform Azure provider, for example:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"export ARM_SUBSCRIPTION_ID=\"\"\nexport ARM_TENANT_ID=\"\"\nexport ARM_CLIENT_ID=\"\"\nexport ARM_CLIENT_SECRET=\"\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"execution-requirements","__idx":8},"children":["Execution requirements"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Docker"]},": Docker Desktop or Docker Engine installed and running."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC Deployer Image"]},": Access to Ripple's Docker registry."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Important:"]}," Contact your Ripple representative to obtain the official MPC Deployer Docker image and required credentials."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"from-ripple","__idx":9},"children":["From Ripple"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before deployment, Ripple will provide:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Item"},"children":["Item"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC Deployer Image"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Official Docker image tag and registry credentials"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tenant Alias"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your organization identifier"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tenant Instance Code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Environment identifier, such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["prod"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["uat"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Docker Registry Credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Access to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["metaco.azurecr.io"]},", where MPC core component images are stored"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OpenTelemetry Endpoint"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Observability service configuration"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Azure setup scripts"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional scripts for pre-provisioning required Azure resources"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"deployment-process","__idx":10},"children":["Deployment process"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The deployment follows a coordinated process between you and Ripple:"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant C as Customer\n participant T as MPC Deployer Tool\n participant AZ as Azure Subscription\n participant R as Ripple\n\n Note over C,AZ: Phase 0: Azure Prerequisites\n C->>AZ: Pre-provision Resource Group, Key Vaults, contract wrapping key, Log Analytics Workspace, and Managed Identity\n C->>T: Provide Azure input values\n\n Note over C,R: Phase 1: Key Generation\n C->>T: Run --keygen mode\n T->>AZ: Store keys in Azure Key Vault\n T->>C: Output Node 2 & 3 Peer IDs\n C->>R: Share Peer IDs\n\n Note over C,R: Phase 2: Ripple Setup\n R->>R: Configure Nodes 0 & 1\n R->>R: Configure Relay Server\n R->>C: Provide Ripple config\n\n Note over C,R: Phase 3: Deployment\n C->>T: Run deployment mode\n T->>AZ: Provision infrastructure\n T->>AZ: Deploy Azure Confidential VMs\n T->>C: Deployment complete\n\n Note over C,R: Phase 4: Verification\n C->>R: Confirm connectivity\n R->>C: Run cluster health check\n","diagramHtml":"RippleAzure SubscriptionMPC Deployer ToolCustomerRippleAzure SubscriptionMPC Deployer ToolCustomerPhase 0: Azure PrerequisitesPhase 1: Key GenerationPhase 2: Ripple SetupPhase 3: DeploymentPhase 4: VerificationPre-provision Resource Group, Key Vaults, contract wrapping key, Log Analytics Workspace, and Managed IdentityProvide Azure input valuesRun --keygen modeStore keys in Azure Key VaultOutput Node 2 & 3 Peer IDsShare Peer IDsConfigure Nodes 0 & 1Configure Relay ServerProvide Ripple configRun deployment modeProvision infrastructureDeploy Azure Confidential VMsDeployment completeConfirm connectivityRun cluster health check","diagramHtmlDark":"RippleAzure SubscriptionMPC Deployer ToolCustomerRippleAzure SubscriptionMPC Deployer ToolCustomerPhase 0: Azure PrerequisitesPhase 1: Key GenerationPhase 2: Ripple SetupPhase 3: DeploymentPhase 4: VerificationPre-provision Resource Group, Key Vaults, contract wrapping key, Log Analytics Workspace, and Managed IdentityProvide Azure input valuesRun --keygen modeStore keys in Azure Key VaultOutput Node 2 & 3 Peer IDsShare Peer IDsConfigure Nodes 0 & 1Configure Relay ServerProvide Ripple configRun deployment modeProvision infrastructureDeploy Azure Confidential VMsDeployment completeConfirm connectivityRun cluster health check"},"children":["sequenceDiagram\n participant C as Customer\n participant T as MPC Deployer Tool\n participant AZ as Azure Subscription\n participant R as Ripple\n\n Note over C,AZ: Phase 0: Azure Prerequisites\n C->>AZ: Pre-provision Resource Group, Key Vaults, contract wrapping key, Log Analytics Workspace, and Managed Identity\n C->>T: Provide Azure input values\n\n Note over C,R: Phase 1: Key Generation\n C->>T: Run --keygen mode\n T->>AZ: Store keys in Azure Key Vault\n T->>C: Output Node 2 & 3 Peer IDs\n C->>R: Share Peer IDs\n\n Note over C,R: Phase 2: Ripple Setup\n R->>R: Configure Nodes 0 & 1\n R->>R: Configure Relay Server\n R->>C: Provide Ripple config\n\n Note over C,R: Phase 3: Deployment\n C->>T: Run deployment mode\n T->>AZ: Provision infrastructure\n T->>AZ: Deploy Azure Confidential VMs\n T->>C: Deployment complete\n\n Note over C,R: Phase 4: Verification\n C->>R: Confirm connectivity\n R->>C: Run cluster health check\n"]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-pre-provision-azure-resources","__idx":11},"children":["Step 1: Pre-provision Azure resources"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before running the deployer, confirm that the following resources exist:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Requirement"},"children":["Requirement"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What to verify"},"children":["What to verify"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Resource group"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The target resource group exists in the primary Azure region"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Standard Key Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["RBAC authorization is enabled and the deployer identity can read and write secrets"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Premium Key Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The vault contains an RSA-4096 HSM-backed wrapping key"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User-assigned managed identity"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The identity exists and can be assigned to the Confidential VMs"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key Vault access"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The managed identity has access to both Key Vaults, or the deployer identity can create the required role assignments"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Either allow the deployer to create the VNet and subnets, or provide two existing subnets"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Outbound connectivity"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Subnets allow outbound HTTPS and connectivity to the Ripple relay host and port"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-generate-node-keys","__idx":12},"children":["Step 2: Generate node keys"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".env"]}," file using the sample provided with your MPC Deployer package. For key generation, include your tenant details, Azure region, and the pre-provisioned Azure resource values."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["At minimum, the key-generation configuration includes:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REGION"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Primary Azure region"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TENANT_ALIAS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your organization identifier"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TENANT_INSTANCE_CODE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Environment code"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_SUBSCRIPTION_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Azure subscription ID"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_RESOURCE_GROUP"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Resource group used by the deployment"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_KEY_VAULT_NAME"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key Vault used for node keys, configuration, and contract tokens"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Generate cryptographic keys for your MPC nodes:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n --env-file .env \\\n -e ARM_SUBSCRIPTION_ID \\\n -e ARM_TENANT_ID \\\n -e ARM_CLIENT_ID \\\n -e ARM_CLIENT_SECRET \\\n -v $(pwd)/output:/app/output \\\n /mpc-deployer: \\\n --provider azure --keygen --output /app/output --non-interactive\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The tool stores the private node keys and KEKs in Azure Key Vault. The output includes the public Peer IDs for Node 2 and Node 3:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"text","header":{"controls":{"copy":{}}},"source":"Key material successfully generated and stored in Azure Key Vault.\nNode 2 Public Key (Peer ID): 12D3KooWBhMevWJT...\nNode 3 Public Key (Peer ID): 12D3KooWCdEfGhIj...\n","lang":"text"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Share with Ripple:"]}," Send the Node 2 and Node 3 Peer IDs to your Ripple representative. These are public identifiers and are safe to share."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-wait-for-ripple-configuration","__idx":13},"children":["Step 3: Wait for Ripple configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple will configure their infrastructure and provide you with:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Configuration"},"children":["Configuration"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Example"},"children":["Example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Relay Host"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["relay.mpc.ripple.com"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Relay Port"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["6000"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Relay Public Key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["12D3KooW..."]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Node 0 Public Key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["12D3KooW..."]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Node 1 Public Key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["12D3KooW..."]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC Docker Image"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["metaco.azurecr.io/harmonize/mpc-core:1.13.12"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Add the following values to your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".env"]}," file before deployment:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC_DOCKER_IMAGE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC core Docker image provided by Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC_DOCKER_REGISTRY_USERNAME"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Docker registry username"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC_DOCKER_REGISTRY_PASSWORD"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Docker registry password"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC_RELAY_HOST"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Relay server host"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC_RELAY_PORT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Relay server port"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC_RELAY_PUBLIC_KEY"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Relay server public key"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC_NODE0_PUBLIC_KEY"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Node 0 public key"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC_NODE1_PUBLIC_KEY"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Node 1 public key"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_NSG_RIPPLE_SAAS_CIDRS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CIDR blocks allowed by the network security groups for Ripple SaaS connectivity"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_NSG_DOCKER_REGISTRY_CIDRS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CIDR blocks allowed by the network security groups for Docker registry access"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OTEL_HTTP_ENDPOINT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenTelemetry endpoint"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OTEL_HTTP_USER"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenTelemetry username"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OTEL_HTTP_PASSWORD"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenTelemetry password"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_WRAPPING_KEY_VAULT_NAME"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Premium Key Vault that holds the contract wrapping key (Azure SKR)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_KEY_WRAPPING_KEY_NAME"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Name of the RSA-4096 HSM-backed contract wrapping key"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RIPPLE_COSIGN_PUBLIC_KEY"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Cosign public key that verifies mpc-core image signatures at CVM boot"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-deploy-mpc-nodes","__idx":14},"children":["Step 4: Deploy MPC nodes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After Ripple provides the cluster configuration, deploy Node 2 and Node 3 to Azure."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"non-interactive-deployment-recommended","__idx":15},"children":["Non-interactive deployment (recommended)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For production deployments, use environment variables with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--non-interactive"]}," flag:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n --env-file .env \\\n -e ARM_SUBSCRIPTION_ID \\\n -e ARM_TENANT_ID \\\n -e ARM_CLIENT_ID \\\n -e ARM_CLIENT_SECRET \\\n -v $(pwd)/output:/app/output \\\n /mpc-deployer: \\\n --provider azure --output /app/output --non-interactive\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"interactive-deployment-fallback","__idx":16},"children":["Interactive deployment (fallback)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you prefer to enter configuration interactively:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n --env-file .env \\\n -e ARM_SUBSCRIPTION_ID \\\n -e ARM_TENANT_ID \\\n -e ARM_CLIENT_ID \\\n -e ARM_CLIENT_SECRET \\\n -v $(pwd)/output:/app/output \\\n /mpc-deployer: \\\n --provider azure --output /app/output\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"deployment-into-an-existing-vnet","__idx":17},"children":["Deployment into an existing VNet"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you have existing subnets, use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}," flag:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n --env-file .env \\\n -e ARM_SUBSCRIPTION_ID \\\n -e ARM_TENANT_ID \\\n -e ARM_CLIENT_ID \\\n -e ARM_CLIENT_SECRET \\\n -v $(pwd)/output:/app/output \\\n /mpc-deployer: \\\n --provider azure --output /app/output --non-interactive --no-create-vpc\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".env"]}," file must include the existing VNet and subnet values required by your deployer package. The two subnets should be in separate availability zones or fault domains when your Azure region and networking design support it."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_PRECONFIGURED_PRIVATE_SUBNET1_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Existing subnet ID for MPC Node 2"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AZURE_PRECONFIGURED_PRIVATE_SUBNET2_ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Existing subnet ID for MPC Node 3"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-5-verify-deployment","__idx":18},"children":["Step 5: Verify deployment"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After deployment completes, verify the Azure infrastructure and node startup."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"check-confidential-vms","__idx":19},"children":["Check Confidential VMs"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Verify that both VMs are running:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az vm list \\\n --resource-group \\\n --show-details \\\n --query \"[?contains(name, 'mpc')].{Name:name,PowerState:powerState,Size:hardwareProfile.vmSize}\" \\\n --output table\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["What to check:"]}," Confirm both MPC VMs show ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VM running"]}," and use the Confidential VM SKU selected for your deployment."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"check-managed-identity-assignment","__idx":20},"children":["Check managed identity assignment"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Confirm that each VM has the expected user-assigned managed identity:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az vm identity show \\\n --resource-group \\\n --name \n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"check-boot-diagnostics","__idx":21},"children":["Check boot diagnostics"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Retrieve the startup log for each VM:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az vm boot-diagnostics get-boot-log \\\n --resource-group \\\n --name \n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["What to check:"]}," Look for log entries indicating that the node retrieved its configuration from Key Vault and connected to the relay server."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"verify-key-vault-entries","__idx":22},"children":["Verify Key Vault entries"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Confirm that deployment secrets exist in the Standard Key Vault:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az keyvault secret list \\\n --vault-name \\\n --query \"[?contains(name, '')].name\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["What to check:"]}," This command lists secret names only and does not reveal key material. Verify that secrets for Node 2 and Node 3 exist."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"command-reference","__idx":23},"children":["Command reference"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Flag"},"children":["Flag"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Default"},"children":["Default"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--output"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Output directory for logs and generated files"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["./output/"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--keygen"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Generate key material for customer nodes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use existing Azure networking instead of creating a VNet and subnets"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--non-interactive"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Disable interactive prompts, recommended for production"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--dry-run"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Simulate deployment without making changes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":24},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"common-issues","__idx":25},"children":["Common issues"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Issue"},"children":["Issue"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Azure credentials error"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing, expired, or unauthorized credentials"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Refresh Azure credentials and verify subscription access"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key Vault access denied"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Managed identity or deployer identity lacks RBAC permissions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Grant the required Key Vault roles before rerunning"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Contract wrapping key not found"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Premium Key Vault or RSA-4096 HSM key is missing or misnamed"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify the Premium Key Vault name and key name"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Confidential VM launch failed"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["VM SKU unavailable, quota exceeded, or region unsupported"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Choose a supported region/SKU or request quota"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["VM cannot retrieve configuration"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Managed identity is not assigned or cannot access Key Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check VM identity assignment and Key Vault RBAC"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Docker registry auth failed"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Invalid registry credentials"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify credentials with Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Relay connection failed"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network blocks outbound relay traffic"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Confirm subnet routing, NSG rules, and proxy configuration"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Role assignment failed"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Deployer identity cannot create role assignments"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Grant the required Key Vault role assignments and rerun the deployment"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"log-files","__idx":26},"children":["Log files"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All deployer operations are logged to the output directory:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Log File"},"children":["Log File"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Content"},"children":["Content"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["output.log"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Main application logs"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cdktf.log"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Infrastructure provisioning logs"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"getting-help","__idx":27},"children":["Getting help"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you encounter issues:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Check log files in the output directory."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify Azure credentials, Key Vault access, and managed identity assignment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Retrieve VM boot diagnostics for Node 2 and Node 3."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Contact your Ripple representative with log files and boot diagnostics."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":28},"children":["Next steps"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After successful deployment, contact your Ripple representative to:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify connectivity"]}," between your nodes and Ripple nodes."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Complete cluster configuration"]}," and run health checks."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Test key generation"]}," using the DKG process."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/backups"},"children":["MPC backups"]}]}," for encrypted shard backups with verifiable encryption."]}]}]},"headings":[{"value":"MPC deployment on Azure","id":"mpc-deployment-on-azure","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"What gets deployed","id":"what-gets-deployed","depth":3},{"value":"Azure resources","id":"azure-resources","depth":3},{"value":"Pre-provisioned resources","id":"pre-provisioned-resources","depth":4},{"value":"Resources created by the deployer","id":"resources-created-by-the-deployer","depth":4},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Azure requirements","id":"azure-requirements","depth":3},{"value":"Execution requirements","id":"execution-requirements","depth":3},{"value":"From Ripple","id":"from-ripple","depth":3},{"value":"Deployment process","id":"deployment-process","depth":2},{"value":"Step 1: Pre-provision Azure resources","id":"step-1-pre-provision-azure-resources","depth":2},{"value":"Step 2: Generate node keys","id":"step-2-generate-node-keys","depth":2},{"value":"Step 3: Wait for Ripple configuration","id":"step-3-wait-for-ripple-configuration","depth":2},{"value":"Step 4: Deploy MPC nodes","id":"step-4-deploy-mpc-nodes","depth":2},{"value":"Non-interactive deployment (recommended)","id":"non-interactive-deployment-recommended","depth":3},{"value":"Interactive deployment (fallback)","id":"interactive-deployment-fallback","depth":3},{"value":"Deployment into an existing VNet","id":"deployment-into-an-existing-vnet","depth":3},{"value":"Step 5: Verify deployment","id":"step-5-verify-deployment","depth":2},{"value":"Check Confidential VMs","id":"check-confidential-vms","depth":3},{"value":"Check managed identity assignment","id":"check-managed-identity-assignment","depth":3},{"value":"Check boot diagnostics","id":"check-boot-diagnostics","depth":3},{"value":"Verify Key Vault entries","id":"verify-key-vault-entries","depth":3},{"value":"Command reference","id":"command-reference","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Common issues","id":"common-issues","depth":3},{"value":"Log files","id":"log-files","depth":3},{"value":"Getting help","id":"getting-help","depth":3},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"MPC deployment on Azure"}},"lastModified":"2026-09-16T09:00:53.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/deployment/integrate-kms/mpc/azure-deployment","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}