{"templateId":"markdown","versions":[{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/deployment/integrate-kms/mpc/disaster-recovery","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/deployment/integrate-kms/mpc/disaster-recovery","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/integrate-kms/mpc/disaster-recovery","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/integrate-kms/mpc/disaster-recovery","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/integrate-kms/mpc/disaster-recovery","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/integrate-kms/mpc/disaster-recovery","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"MPC disaster recovery","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"mpc-disaster-recovery","__idx":0},"children":["MPC disaster recovery"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page describes how to deploy MPC nodes to a secondary AWS region for disaster recovery (DR) purposes using the MPC Deployer tool."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide assumes you have completed the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/aws-deployment"},"children":["MPC deployment on AWS"]}," guide and have a working MPC cluster in your primary region."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In a disaster recovery scenario, you can deploy your customer MPC nodes (Node 2 and Node 3) to a secondary AWS region to maintain signing availability. The MPC Deployer's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--disaster-recovery"]}," flag automates this process by:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Reading configuration from AWS Secrets Manager (which replicates to your secondary region)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Provisioning infrastructure in the secondary region"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Deploying MPC nodes with the same key material as your primary region"]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["DR mode deploys ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["additional"]}," MPC nodes. It does not replace your primary deployment. Both deployments share the same key material stored in AWS Secrets Manager."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before deploying to a secondary region, ensure you have:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Prerequisite"},"children":["Prerequisite"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Primary MPC deployment"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A working MPC cluster deployed using the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/aws-deployment"},"children":["AWS deployment guide"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Secondary region configured"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secondaryRegion"]}," field set in your Secrets Manager configuration during initial key generation"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Secrets Manager replication"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your MPC configuration secret replicated to the secondary region"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AWS credentials"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Permissions to create resources in the secondary region"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"verify-secrets-manager-replication","__idx":3},"children":["Verify Secrets Manager replication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your MPC configuration secret must be replicated to the secondary region. To verify replication status:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"aws secretsmanager describe-secret \\\n  --secret-id mpc-deployer-<TENANT_ALIAS>-<INSTANCE_CODE> \\\n  --region <PRIMARY_REGION>\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check that the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ReplicationStatus"]}," array includes your secondary region with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Status: InSync"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["AWS Secrets Manager replication is configured automatically during the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--keygen"]}," phase if you provide a secondary region. If replication is not enabled, contact your Ripple representative."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"pre-configured-vpc-requirements","__idx":4},"children":["Pre-configured VPC requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If using the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}," flag, ensure the following fields are set in your Secrets Manager configuration:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredDrVpcId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["VPC ID in the secondary region"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredDrPrivateSubnet1Id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["First private subnet ID (in a different AZ than the second)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredDrPrivateSubnet2Id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Second private subnet ID (in a different AZ than the first)"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The VPC must have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Private subnets in at least two availability zones"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["NAT gateway or VPC endpoints for outbound connectivity to AWS services"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Security groups allowing outbound HTTPS (443) and the MPC relay port"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"deploy-mpc-nodes-to-the-secondary-region","__idx":5},"children":["Deploy MPC nodes to the secondary region"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Run the MPC Deployer with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--disaster-recovery"]}," flag to deploy nodes to your secondary region."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-1-set-environment-variables","__idx":6},"children":["Step 1: Set environment variables"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Configure your AWS credentials and tenant information:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"export AWS_ACCESS_KEY_ID=\"your-access-key\"\nexport AWS_SECRET_ACCESS_KEY=\"your-secret-key\"\nexport AWS_REGION=\"<SECONDARY_REGION>\"\nexport TENANT_ALIAS=\"<your-tenant-alias>\"\nexport TENANT_INSTANCE_CODE=\"<your-instance-code>\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AWS_REGION"]}," to your ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["secondary"]}," region. The deployer reads configuration from the secondary region's Secrets Manager to do the deployment."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-2-run-the-dr-deployment","__idx":7},"children":["Step 2: Run the DR deployment"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Option A: Auto-create VPC"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The deployer creates all networking resources in the secondary region:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n  -e AWS_ACCESS_KEY_ID \\\n  -e AWS_SECRET_ACCESS_KEY \\\n  -e AWS_REGION \\\n  -e TENANT_ALIAS \\\n  -e TENANT_INSTANCE_CODE \\\n  -v $(pwd)/output:/app/output \\\n  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \\\n  --disaster-recovery --non-interactive\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Option B: Use pre-configured VPC"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The deployer uses your existing VPC and subnets in the secondary region:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n  -e AWS_ACCESS_KEY_ID \\\n  -e AWS_SECRET_ACCESS_KEY \\\n  -e AWS_REGION \\\n  -e TENANT_ALIAS \\\n  -e TENANT_INSTANCE_CODE \\\n  -v $(pwd)/output:/app/output \\\n  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \\\n  --disaster-recovery --non-interactive --no-create-vpc\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-3-verify-deployment","__idx":8},"children":["Step 3: Verify deployment"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After deployment completes, verify the DR nodes are running:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"aws ec2 describe-instances \\\n  --region <SECONDARY_REGION> \\\n  --filters \"Name=tag:Name,Values=*-dr\" \\\n  --query 'Reservations[].Instances[].{ID:InstanceId,State:State.Name,Name:Tags[?Key==`Name`].Value|[0]}'\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check CloudWatch logs in the secondary region to confirm the nodes connected to the relay server."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"dr-mode-behavior","__idx":9},"children":["DR mode behavior"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"resource-naming","__idx":10},"children":["Resource naming"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All resources created in DR mode are suffixed with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["-dr"]}," to distinguish them from primary resources:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Resource type"},"children":["Resource type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Primary name example"},"children":["Primary name example"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"DR name example"},"children":["DR name example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["EC2 instance"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tenant-001-mpc-node-2"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tenant-001-mpc-node-2-dr"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Security group"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tenant-001-enclave-sg"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tenant-001-enclave-sg-dr"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["IAM role"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tenant-001-enclave-role"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tenant-001-enclave-role-dr"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CloudWatch log group"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/mpc/tenant-001/node-2"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/mpc/tenant-001/node-2-dr"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configuration-mapping","__idx":11},"children":["Configuration mapping"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The deployer maps configuration fields to the secondary region:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Configuration field"},"children":["Configuration field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Used in primary mode"},"children":["Used in primary mode"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Used in DR mode"},"children":["Used in DR mode"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["region"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✓"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["—"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secondaryRegion"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["—"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✓"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredVpcId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✓"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["—"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredDrVpcId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["—"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✓"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredPrivateSubnet1Id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✓"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["—"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredDrPrivateSubnet1Id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["—"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✓"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredPrivateSubnet2Id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✓"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["—"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["awsPreconfiguredDrPrivateSubnet2Id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["—"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✓"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"ami-selection","__idx":12},"children":["AMI selection"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["AMI IDs are region-specific. DR mode automatically looks up the correct Amazon Linux 2023 AMI in the secondary region using the same AMI name pattern as primary deployments."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"deprovision-dr-resources","__idx":13},"children":["Deprovision DR resources"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To remove DR resources while keeping your primary deployment intact:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n  -e AWS_ACCESS_KEY_ID \\\n  -e AWS_SECRET_ACCESS_KEY \\\n  -e AWS_REGION \\\n  -e TENANT_ALIAS \\\n  -e TENANT_INSTANCE_CODE \\\n  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \\\n  --delete --disaster-recovery --non-interactive\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you used ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}," during deployment, include that flag when deleting:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"docker run --rm -it \\\n  -e AWS_ACCESS_KEY_ID \\\n  -e AWS_SECRET_ACCESS_KEY \\\n  -e AWS_REGION \\\n  -e TENANT_ALIAS \\\n  -e TENANT_INSTANCE_CODE \\\n  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \\\n  --delete --disaster-recovery --non-interactive --no-create-vpc\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Deprovisioning removes all DR infrastructure in the secondary region. Your MPC configuration in AWS Secrets Manager is retained, allowing you to redeploy DR nodes if needed."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"command-reference","__idx":14},"children":["Command reference"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following flags are specific to disaster recovery operations:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Flag"},"children":["Flag"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--disaster-recovery"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Deploy to the secondary region specified in your Secrets Manager configuration"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--delete"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Remove deployed resources (combine with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--disaster-recovery"]}," to remove only DR resources)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--no-create-vpc"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use pre-configured VPC instead of creating networking resources"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--non-interactive"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Run without prompts (recommended for automated deployments)"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For a complete list of MPC Deployer flags, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/aws-deployment#command-reference"},"children":["MPC deployment on AWS"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":15},"children":["Next steps"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verify connectivity"]},": Contact your Ripple representative to confirm DR nodes can participate in signing operations"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up monitoring"]},": Configure CloudWatch alarms for DR node health in the secondary region"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Test failover"]},": Periodically test your DR deployment by simulating primary region unavailability"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review backups"]},": Ensure you have ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/backups"},"children":["MPC backups"]}," configured for key shard recovery"]}]}]},"headings":[{"value":"MPC disaster recovery","id":"mpc-disaster-recovery","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Verify Secrets Manager replication","id":"verify-secrets-manager-replication","depth":3},{"value":"Pre-configured VPC requirements","id":"pre-configured-vpc-requirements","depth":3},{"value":"Deploy MPC nodes to the secondary region","id":"deploy-mpc-nodes-to-the-secondary-region","depth":2},{"value":"Step 1: Set environment variables","id":"step-1-set-environment-variables","depth":3},{"value":"Step 2: Run the DR deployment","id":"step-2-run-the-dr-deployment","depth":3},{"value":"Step 3: Verify deployment","id":"step-3-verify-deployment","depth":3},{"value":"DR mode behavior","id":"dr-mode-behavior","depth":2},{"value":"Resource naming","id":"resource-naming","depth":3},{"value":"Configuration mapping","id":"configuration-mapping","depth":3},{"value":"AMI selection","id":"ami-selection","depth":3},{"value":"Deprovision DR resources","id":"deprovision-dr-resources","depth":2},{"value":"Command reference","id":"command-reference","depth":2},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"MPC disaster recovery"}},"lastModified":"2026-08-04T20:25:11.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/deployment/integrate-kms/mpc/disaster-recovery","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}