Skip to main content
Version: 1.13.0

AWS

Sodot MPC Vertex is a self-hosted deployable service that represents an MPC party for MPC operations (such as keygen, sign, refresh etc.). It takes care of storing the secret share, as well as running the MPC operations themselves. It can be used seamlessly with all Sodot MPC SDKs. The Vertex exposes a REST API, documented here, that allows creating and managing secret shares easily.

Architecture​

The self-hosted solution comes as a dedicated Terraform module which should be run on your organization's computing infrastructure. We recommend you first look at our example Terraform module and modify it according to your organization's needs. Each operating mode (with or without the usage of AWS Nitro) has its own shell script that will be loaded to the relevant machines as part of the installation process - those will be covered later in this guide.

Requirements​

Before starting the installation process, make sure you have the following installed:

  1. The terraform CLI.
  2. The aws CLI tool for AWS.
  3. Make sure you are logged in (i.e aws sso login).
  4. Make sure your account has permissions to create resources (such as EC2 instances, RDS instances, etc...).

In addition, this guide assumes you're running the provided example Terraform module as the root module (although most steps are applicable when running it as a submodule as well).

Installation Process​

The installation process is made of the following steps:

  1. Collecting installation parameters
  2. Obtaining a TLS certificate
  3. Obtaining the Terraform module
  4. Applying the Terraform module to your cloud environment
  5. Setting the DNS Record for URL_ENDPOINT to point to the Vertex

1. Collecting Parameters​

At this step you should collect the following pieces of information, listed down below. At the end of each bullet we put in parentheses a capitalized name which will be used to refer to the value being set throughout the rest of this guide.

  1. The endpoint URL that you wish to host your Vertex at (URL_ENDPOINT).
  2. The Sodot Docker registry user and token which provides access to all relevant Helm charts, Docker images and Terraform modules (ARTIFACTORY_USER and ARTIFACTORY_TOKEN). You can obtain these by following the Obtaining Credentials guide.
  3. Your organization's Sodot Relay API key (RELAY_API_KEY) and URL (RELAY_URL).
  4. Decide on a secret admin token that will be used to provision new users using the Vertex (ADMIN_TOKEN).
  5. The product you wish to deploy over the Vertex (PRODUCT). Currently, the supported products are mpc-infra and exchange-api-vault.

2. Obtaining a TLS Certificate​

You should obtain a TLS cerificate for the URL_ENDPOINT domain via AWS Certificate Manager. The certificate can either be requested or imported from an existing certificate. We will need the unique ARN of your certificate (TLS_CERT_ARN).

3. Obtaining the Terraform Module​

You can consume the Vertex Terraform module from the Sodot private registry in one of two ways:

A. Use the module directly from the registry​

First, you'll need to log in to the Sodot Docker registry using the credentials you obtained in the previous step.

terraform login repo.sodot.dev

Then, you can use the module directly from the registry by adding it to your Terraform configuration. Add the following block to your main.tf (or similar) and run terraform init. Terraform will pull the module from your JFrog Artifactory registry at runtime.

module "vertex" {
  source  = "repo.sodot.dev/sodot-terraform-modules__sodot/vertex/aws"
  ...
}

B. Download the raw Terraform module to customize it​

  1. Fetch the desired release (replace <VERSION> with a tag such as v1.10.1):
curl -u "<ARTIFACTORY_USER>:<ARTIFACTORY_TOKEN>" \
  -O "https://repo.sodot.dev/artifactory/sodot-terraform-modules/sodot/vertex/aws/<VERSION>.zip"

Alternatively, you can use the Artifactory GUI instead.

  1. Unzip and make it your root module:
unzip <VERSION>.zip -d vertex
cd vertex

4. Applying the Terraform Module to Your Cloud Environment​

Setting up the relevant infrastructure is performed by running terraform init followed by terraform apply. Where you run those commands depends on the option you chose in Obtaining the Terraform Module.

Configuring Terraform​

The module’s inputs are declared in variables.tf and have sensible defaults where appropriate. You must supply the following variables when invoking both terraform apply and terraform destroy:

  • region - the AWS region at which the infrastructure will be provisioned.
  • artifactory_user=<ARTIFACTORY_USER> - provides Terraform with permissions to pull the Helm chart and the Vertex Docker image.
  • artifactory_token=<ARTIFACTORY_TOKEN> - provides Terraform with permissions to pull the Helm chart and the Vertex Docker image.
  • product_name=<PRODUCT> - the Sodot product to deploy over the Vertex (e.g. mpc-infra or exchange-api-vault).
  • tls_certificate_arn=<TLS_CERT_ARN> - the ARN for a TLS certificate, as described in the Obtaining TLS Certificate section.
  • vertex_admin_token=<ADMIN_TOKEN> - the secret admin token that will be used to set up all other users of the Vertex.
  • vertex_relay_api_key=<RELAY_API_KEY> - an API key for accessing the Sodot Relay Server.
  • vertex_relay_address=<RELAY_URL> - the URL for your organization's deployed Relay Server. While technically not required, this will point to a public non-production Relay server which should be replaced with your organization's own deployment.

The rest of the variables have sensible defaults, but it is recommended to go over them and customize them for your own needs.

  • vertex_image_tag - the version of the underlying Vertex used.
  • db_instance_type - which instance type to use for the RDS instance.
  • vertex_instance_type - which instance type to use for the Vertex.
  • min_size - the minimum number of Vertex instances for the Vertex Auto-Scaling Group.
  • max_size - the maximum number of Vertex instances for the Vertex Auto-Scaling Group.
  • desired_capacity - the maximum number of Vertex instances for the Vertex Auto-Scaling Group.
  • nitro_enclave_enabled - whether to enable the Nitro secure enclave feature.

Example for option B (inside the unzipped directory):

terraform init

terraform apply \
    -var "region=us-east-1" \
    -var "tls_certificate_arn=arn:aws:acm:XXX" \
    -var "artifactory_user=my-artifactory-user" \
    -var "artifactory_token=my-artifactory-token" \
    -var "product_name=mpc-infra" \
    -var "vertex_relay_api_key=ABEiM0RVZneImaq7zN3u8g==" \
    -var "vertex_relay_address=my-relay.XXXXX.com" \
    -var "vertex_admin_token=XXXXXXXXXXXXXXXXXX" \
    -var "nitro_enclave_enabled=true" \
    -var "db_instance_type=db.t3.micro" \
    -var "vertex_instance_type=c5.4xlarge" \
    -var "min_size=2" \
    -var "max_size=5" \
    -var "desired_capacity=3"

Nitro​

When running in with Nitro enabled (nitro_enclave_enabled=true), several other variables can be configured:

  • enclave_allocated_memory - the amount of memory allocated for the Nitro enclave. Both the parent instance and the enclave itself should have at least 4GB of memory.
  • enclave_allocated_vcpus - the amount of vcpus allocated for the Nitro enclave. The parent should have at least 2 vcpus while the enclave should have at least 4.

OpenTelemetry​

OpenTelemetry outputs can be enabled for the Vertex. This default implementation will direct all the Vertex OTLP communication to an internal ADOT collector, whose configuration is located in the adot_config.yaml file inside the Terraform module.

  • enable_opentelemetry - enable OpenTelemetry outputs from the Vertex. Directed to the local ADOT collector by default.
  • opentelemetry_endpoint - the endpoint the Vertex will send all OTLP communication to - defaults to the local ADOT collector.

For option A, run the same command from the root module that references module "vertex".

5. Setting the DNS Record for URL_ENDPOINT to Point to the Vertex​

After running terraform apply there will be an address for an AWS Load Balancer that points to your Vertex Auto-Scaling Group named "Public URL".

You will need to create a record for URL_ENDPOINT that points to that load balancer. Then, at https://URL_ENDPOINT you will be able to communicate with your Vertex.

After that, you can run:

curl https://URL_ENDPOINT/health -vvv

To verify that you get an empty 200 OK response from the Vertex and that it is indeed up and running.