MPC deployment on AWS

This guide covers deploying customer MPC nodes (Node 2 and Node 3) to AWS using the MPC Deployer tool.

The MPC Deployer automates the deployment of customer MPC nodes to AWS Nitro Enclaves, providing hardware-based isolation for key material.

Account & permissions:

• AWS account with administrative access
• Permissions allowing the deployer tool to create resources in the AWS account

Credentials (one of):

# Option 1: Environment variables
export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_DEFAULT_REGION="us-east-1"

# Option 2: AWS credentials file (~/.aws/credentials)
[default]
aws_access_key_id = your-access-key
aws_secret_access_key = your-secret-key
region = us-east-1

• Docker: Docker Desktop or Docker Engine installed and running
• MPC Deployer Image: Access to Ripple's Docker registry

Before deployment, Ripple will provide:

The deployment follows a coordinated process between you and Ripple:

Generate cryptographic keys for your MPC nodes (Node 2 and Node 3):

docker run --rm -it \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_DEFAULT_REGION \
  -v $(pwd)/output:/app/output \
  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \
  --keygen --output /app/output

The tool will prompt for:

• Region: Primary AWS region (e.g., us-east-1)
• Secondary region: DR region (e.g., us-west-2).
• Tenant alias: Your organization identifier.
• Tenant Instance Code: Environment code

Output:

🎉 Key material successfully generated and stored in AWS Secrets Manager.
🔑 Node 2 Public Key (Peer ID): 12D3KooWBhMevWJT...
🔑 Node 3 Public Key (Peer ID): 12D3KooWCdEfGhIj...

Ripple will configure their infrastructure and provide you with:

Once you receive configuration from Ripple, deploy the infrastructure:

For production deployments, use environment variables with the --non-interactive flag:

# Create .env file with configuration
cat > .env << EOF
REGION=us-east-1
SECONDARY_REGION=us-west-2
TENANT_ALIAS=your-tenant
TENANT_INSTANCE_CODE=prod

MPC_DOCKER_IMAGE=metaco.azurecr.io/custody/mpc-core:1.3.12
MPC_DOCKER_REGISTRY_USERNAME=your-username
MPC_DOCKER_REGISTRY_PASSWORD=your-password

MPC_RELAY_HOST=relay.mpc.ripple.com
MPC_RELAY_PORT=6000
MPC_RELAY_PUBLIC_KEY=12D3KooW...
MPC_NODE0_PUBLIC_KEY=12D3KooW...
MPC_NODE1_PUBLIC_KEY=12D3KooW...

OTEL_HTTP_ENDPOINT=https://your-otel-endpoint
OTEL_HTTP_USER=your-username
OTEL_HTTP_PASSWORD=your-password

ENCLAVE_DECRYPTION_SERVER_URL=https://decrypter.metaco.services
EOF

# Run deployment
docker run --rm -it \
  --env-file .env \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -v $(pwd)/output:/app/output \
  -v $(pwd)/.terraform-state:/terraform-state \
  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \
  --output /app/output --non-interactive

If you prefer to enter configuration interactively:

docker run --rm -it \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_DEFAULT_REGION \
  -v $(pwd)/output:/app/output \
  -v $(pwd)/.terraform-state:/terraform-state \
  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \
  --output /app/output

The tool will prompt for all required configuration. Previously stored values (from key generation) will be pre-populated from AWS Secrets Manager.

If you have an existing VPC, use the --no-create-vpc flag:

docker run --rm -it \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_DEFAULT_REGION \
  -v $(pwd)/output:/app/output \
  -v $(pwd)/.terraform-state:/terraform-state \
  <RIPPLE_REGISTRY>/mpc-deployer:<VERSION> \
  --output /app/output --no-create-vpc

You will be prompted for:

• VPC ID: vpc-0123456789abcdef0
• Private Subnet 1 ID: subnet-0123456789abcdef0
• Private Subnet 2 ID: subnet-0123456789abcdef1

Both subnets must be private and in separate Availability Zones. MPC nodes are outbound-only — each node dials the relay server and nothing ever connects to them — so a public subnet adds internet-reachable attack surface with no benefit.

After deployment completes, verify the infrastructure:

Verify that the Nitro Enclave instances are running and have the correct instance type:

aws ec2 describe-instances \
  --filters "Name=tag:Type,Values=nitro-enclave" \
  --query 'Reservations[].Instances[].{ID:InstanceId,State:State.Name,Type:InstanceType}'

Verify that log groups exist and contain enclave boot logs:

aws logs describe-log-groups \
  --log-group-name-prefix "<TENANT_ALIAS>-<INSTANCE_CODE>"

Confirm that secrets were created for your deployment:

aws secretsmanager list-secrets \
  --filter Key=name,Values="<TENANT_ALIAS>-<INSTANCE_CODE>"

All operations are logged to the output directory:

If you encounter issues:

1. Check log files in the output directory
2. Verify AWS credentials and permissions
3. Contact your Ripple representative with log files

After successful deployment, contact your Ripple representative to:

1. Verify connectivity between your nodes and Ripple nodes
2. Complete cluster configuration and run health checks
3. Test key generation using the DKG process
4. Set up MPC backups for encrypted shard backups with verifiable encryption
5. Review Production best practices for namespace segmentation, HA, and monitoring