Deployment Specifications

Recommended Service and Infrastructure Sizing

Here is a comprehensive list of Institutional Vault AWS-recommended services and infrastructure sizes:

Service Name	Resource Type	CPU Cores	Memory (GB)	Replicas	AWS Specification
Wallet service	microservice container	1	1	3	container
Message Broker	microservice container	0.5	0.5	3	container
MPA Policy-node 0	virtual machine instance	4	16	2	m5.2xlarge
MPA Policy-node 1	virtual machine instance	4	16	2	m5.2xlarge
MPA Policy-node 2	virtual machine instance	4	16	2	m5.2xlarge
Relational Database	database PaaS	2	4	N/A	t4g.medium

Deployed AWS Infrastructure Components

The CDK long-lived, wallet, and Policy Node stacks provision these AWS services and supporting infrastructure:

Supporting service	Technology
Infrastructure deployment	CDK / CloudFormation
Certificate management	ACM
Container orchestration	ECS (Fargate)
Policy Node compute	EC2
Confidential computing	Nitro Enclaves
Secrets management	Secrets Manager
Key management	KMS
Database management	RDS (PostgreSQL)
DNS management	Route 53, Cloud Map
Monitoring and logging	CloudWatch
Software distribution	ECR
Network isolation and management	VPC
Load balancing	Application Load Balancer (ALB)
Content delivery	CloudFront
Object storage	S3
Shared file storage	EFS
Log export	Lambda
Web application firewall	WAF (optional IP allowlist)

Authentication uses your customer OpenID Connect identity provider (OAuth/OIDC). The wallet integrates with that IdP; Blockdaemon does not provision the IdP in your AWS account.

Service Limits and Quotas

You don't need to request any limit increases for default Service Quotas when using the Automated AWS deployment tooling.

Network and Firewall Ports

The table below summarizes the minimum network and firewall rules required for the Institutional Vault AWS ECS deployment. Wallet and message-broker workloads run on ECS (Fargate). Policy Nodes run on EC2 with Nitro Enclaves and initiate outbound-only connections to the message broker (no inbound broker connectivity from the internet).

Source	Destination	Protocol / Port(s)	Purpose / Notes
External users / administrators (External Network)	CloudFront distribution / Application Load Balancer (ALB)	TCP 443 (HTTP 80 opt.)	Wallet UI / API, approval flows, and webhook endpoints. HTTP 80 is used only for HTTPS redirect.
Wallet ECS tasks, MPA Policy Node EC2 hosts	Amazon RDS for PostgreSQL	TCP 5432	Application database traffic from wallet services and MPA Policy Nodes to RDS.
Wallet ECS tasks, EVM tracker ECS tasks	NATS ECS service (3-task cluster) / internal Network Load Balancer	TCP 4222, 8222, 8443	Internal message bus (NATS) in core cluster mode for wallet orchestration messaging.
MPA Policy Node EC2 hosts (Nitro)	NATS cluster endpoint / NLB (`nats` Cloud Map or private hostname)	TCP 4222 (mTLS)	Policy Node broker connectivity. Policy Nodes connect outbound only to the broker.
Wallet ECS tasks, MPA Policy Node EC2 hosts	VPC DNS / Amazon Route 53 Resolver	UDP/TCP 53	DNS resolution inside the VPC (including Cloud Map service discovery names).
Wallet ECS tasks, MPA Policy Node EC2 hosts	AWS regional APIs (Secrets Manager, KMS, ECR, S3, CloudWatch, STS)	TCP 443	Outbound HTTPS for secrets, key management, image pulls, config/objects, logging, and AWS control-plane APIs. Policy Nodes use this for OIDC key discovery and optionally Secrets Manager / KMS (including Nitro attestation-gated secret release).
Wallet ECS tasks, MPA Policy Node EC2 hosts	Customer OIDC identity provider	TCP 443	Outbound HTTPS for identity and OIDC discovery / JWKS.
Wallet ECS tasks	External / internal blockchain node RPC endpoints	TCP 443, 8555–8556, 8546	Node RPC connectivity for on-chain operations over HTTPS and WebSocket.
Wallet ECS tasks	Blockdaemon API (`https://svc.blockdaemon.com`)	TCP 443	Blockchain data, staking, token, pricing, balance and transaction queries via Blockdaemon.
Wallet ECS tasks	WalletConnect relay (`wss://relay.walletconnect.com`) and Verify API (`https://verify.walletconnect.org`)	TCP 443	WalletConnect v2 relay for dApp sessions and signing, plus domain verification / anti-phishing checks.
Wallet ECS tasks	ApproverApp Expo push service (`https://expo.host`)	TCP 443	Outbound push notifications to mobile devices via Expo push notification service.
Wallet ECS tasks	Customer SMTP relay (configured `host:port`) (optional)	TCP 587, 465, or as configured	Email notifications to approvers when SMTP relay is enabled. Required only when email notifications are configured.
Wallet ECS tasks	Chainalysis KYT API (`https://api.chainalysis.com`) (optional)	TCP 443	KYT compliance screening for withdrawal and deposit transactions. Required only when Chainalysis integration is enabled.
Wallet ECS tasks	Canton validator, scan API and DA Utilities (`https://api.utilities.digitalasset.com`) (optional)	TCP 443, gRPC 443	Canton ledger, validator and scan API access, plus Digital Asset utility services. Required only when Canton/Daml blockchain support is enabled.

These ports should be reflected in any perimeter firewall, VPC security groups / network ACLs, and on-prem network controls used in the deployment.