Deployment Specifications
Recommended Service and Infrastructure Sizing
Here is a comprehensive list of Institutional Vault AWS-recommended services and infrastructure sizes:
| Service Name | Resource Type | CPU Cores | Memory (GB) | AWS Specification |
|---|---|---|---|---|
| Wallet service | microservice container | 1 | 1 | container |
| Message Broker | microservice container | 0.5 | 0.5 | container |
| MPA Policy-nodes (x3) | virtual machine instance | 4 | 16 | m5.xlarge |
| Relational Database | database PaaS | 2 | 4 | t4g.medium |
Deployed AWS Infrastructure Components
The CDK long-lived, wallet, and Policy Node stacks provision these AWS services and supporting infrastructure:
| Supporting service | Technology |
|---|---|
| Infrastructure deployment | CDK / CloudFormation |
| Certificate management | ACM |
| Container orchestration | ECS (Fargate) |
| Policy Node compute | EC2 |
| Confidential computing | Nitro Enclaves |
| Secrets management | Secrets Manager |
| Key management | KMS |
| Database management | RDS (PostgreSQL) |
| DNS management | Route 53, Cloud Map |
| Monitoring and logging | CloudWatch |
| Software distribution | ECR |
| Network isolation and management | VPC |
| Load balancing | Application Load Balancer (ALB) |
| Content delivery | CloudFront |
| Object storage | S3 |
| Shared file storage | EFS |
| Log export | Lambda |
| Web application firewall | WAF (optional IP allowlist) |
Authentication uses your customer OpenID Connect identity provider (OAuth/OIDC). The wallet integrates with that IdP; Blockdaemon does not provision the IdP in your AWS account.
Service Limits and Quotas
You don't need to request any limit increases for default Service Quotas when using the Automated AWS deployment tooling.
Network and Firewall Ports
The table below summarizes the minimum network and firewall rules required for the Institutional Vault AWS ECS deployment. Wallet and message-broker workloads run on ECS (Fargate). Policy Nodes run on EC2 with Nitro Enclaves and initiate outbound-only connections to the message broker (no inbound broker connectivity from the internet).
| Source | Destination | Protocol / Port(s) | Purpose / Notes |
|---|---|---|---|
| External users / administrators (External Network) | CloudFront distribution / Application Load Balancer (ALB) | TCP 443 (HTTP 80 opt.) | Wallet UI / API, approval flows, and webhook endpoints. HTTP 80 is used only for HTTPS redirect. |
| Wallet ECS tasks, MPA Policy Node EC2 hosts | Amazon RDS for PostgreSQL | TCP 5432 | Application database traffic from wallet services and MPA Policy Nodes to RDS. |
| Wallet ECS tasks, EVM tracker ECS tasks | NATS ECS service / internal Network Load Balancer | TCP 4222, 8222, 8443 | Internal message bus (NATS) used by wallet services for orchestration messaging. |
| MPA Policy Node EC2 hosts (Nitro) | NATS internal endpoint / NLB (nats Cloud Map or private hostname) |
TCP 4222 (mTLS) | Policy Node broker connectivity. Policy Nodes connect outbound only to the broker. |
| Wallet ECS tasks, MPA Policy Node EC2 hosts | VPC DNS / Amazon Route 53 Resolver | UDP/TCP 53 | DNS resolution inside the VPC (including Cloud Map service discovery names). |
| Wallet ECS tasks, MPA Policy Node EC2 hosts | AWS regional APIs (Secrets Manager, KMS, ECR, S3, CloudWatch, STS) | TCP 443 | Outbound HTTPS for secrets, key management, image pulls, config/objects, logging, and AWS control-plane APIs. Policy Nodes use this for OIDC key discovery and optionally Secrets Manager / KMS (including Nitro attestation-gated secret release). |
| Wallet ECS tasks, MPA Policy Node EC2 hosts | Customer OIDC identity provider | TCP 443 | Outbound HTTPS for identity and OIDC discovery / JWKS. |
| Wallet ECS tasks | External / internal blockchain node RPC endpoints | TCP 443, 8555–8556, 8546 | Node RPC connectivity for on-chain operations over HTTPS and WebSocket. |
| Wallet ECS tasks | Blockdaemon API (https://svc.blockdaemon.com) |
TCP 443 | Blockchain data, staking, token, pricing, balance and transaction queries via Blockdaemon. |
| Wallet ECS tasks | WalletConnect relay (wss://relay.walletconnect.com) and Verify API (https://verify.walletconnect.org) |
TCP 443 | WalletConnect v2 relay for dApp sessions and signing, plus domain verification / anti-phishing checks. |
| Wallet ECS tasks | ApproverApp Expo push service (https://expo.host) |
TCP 443 | Outbound push notifications to mobile devices via Expo push notification service. |
| Wallet ECS tasks | Customer SMTP relay (configured host:port) (optional) |
TCP 587, 465, or as configured | Email notifications to approvers when SMTP relay is enabled. Required only when email notifications are configured. |
| Wallet ECS tasks | Chainalysis KYT API (https://api.chainalysis.com) (optional) |
TCP 443 | KYT compliance screening for withdrawal and deposit transactions. Required only when Chainalysis integration is enabled. |
| Wallet ECS tasks | Canton validator, scan API and DA Utilities (https://api.utilities.digitalasset.com) (optional) |
TCP 443, gRPC 443 | Canton ledger, validator and scan API access, plus Digital Asset utility services. Required only when Canton/Daml blockchain support is enabled. |
These ports should be reflected in any perimeter firewall, VPC security groups / network ACLs, and on-prem network controls used in the deployment.