AWS CloudFormation

The RTGS.global Signing Module can be deployed to AWS ECS Fargate using the provided CloudFormation template signing-stack.yaml.

The template creates a full VPC with public and private subnets, RDS PostgreSQL, EFS, two Application Load Balancers, and four ECS services: admin-api, didcomm-agent, svix, and signing-service.

Prerequisites

1. Onboarded participant — the participant must be onboarded to RTGS.global before deploying. The onboarding welcome email contains:

   • RtgsGlobalId — your RTGS.global ID (e.g. RTGS:B:GB98765432)
   • AgentInvitation — the agent invitation string required by the signing service

2. ACM certificate — issue or import a certificate in ACM for your DidcommHostname. The public ALB listener requires it.

3. DNS record — create a CNAME/alias for DidcommHostname pointing to the PublicAlbDnsName stack output after deployment.

Deploy

Download deploy-cloudformation.sh

The PostgreSQL password, wallet key, Svix JWT secret, and database names are all generated automatically if not supplied — see Auto-generated values below.

Parameters

Parameter	Required	Notes
WalletSeed	Yes	GUID seed used to derive the DID/Verkey registered on Indicio
AdminApiKey	Yes	Shared key between signing-service and admin-api
RtgsGlobalId	Yes	From onboarding email, e.g. RTGS:B:GB98765432
AgentInvitation	Yes	From onboarding email
JurisdictionCode	Yes	e.g. euwsbx
DidcommHostname	Yes	Public hostname for the DIDComm agent
CertificateArn	Yes	ACM certificate ARN for the public ALB
EnvironmentName	No	sbx, or prd — selects the Indicio ledger. Default: sbx
AgentImageTag	No	Tag for the signing-agent image. Default: latest-release
ServiceImageTag	No	Tag for the gateway-signing image. Default: latest-release
WalletKey	No	Auto-generated if omitted — see note below
SvixJwtSecret	No	Auto-generated if omitted
SvixEndpoint{0-2}Uid / Url	No	Up to 3 pre-configured Svix webhook endpoints
SvixWhitelistSubnets	No	JSON array of IP ranges Svix may deliver webhooks to, e.g. ["10.0.0.0/8"]
RtgsDbName / WalletName / SvixDbName	No	Derived from RtgsGlobalId if omitted (colons replaced with underscores)
MultiAzDatabase	No	true for production HA. Default: false
GenesisUrl / TaaVersion	No	Override Indicio ledger defaults
EventGridTopicEndpoint / EventGridTopicAccessKey	No	Legacy Azure Event Grid integration

Auto-generated values

The following are created automatically on first deploy and stored in Secrets Manager under <stack-name>/*:

Secret path	Notes
<stack-name>/postgres-password	32-character random password
<stack-name>/wallet-key	32-character random key for Aries wallet encryption
<stack-name>/svix-jwt-secret	64-character random secret for the Svix JWT generator

Database names default to the RtgsGlobalId with colons replaced by underscores. For RTGS:B:GB98765432:

• RtgsDbName → RTGS_Global_Data_RTGS_B_GB98765432
• WalletName → RTGS_Global_Wallet_RTGS_B_GB98765432
• SvixDbName → RTGS_Global_Svix_RTGS_B_GB98765432

warning

The wallet key is generated once and preserved across stack updates. If you delete the stack and recreate it, a new key is generated and the EFS wallet backup becomes unrecoverable. Retrieve the key from Secrets Manager before deleting the stack and supply it as WalletKey on the next deploy.

Post-deployment

1. Point your DidcommHostname DNS record to the PublicAlbDnsName stack output.
2. The signing service is reachable at InternalAlbDnsName (private, within the VPC only).
3. Logs are in CloudWatch under /ecs/<stack-name>, retained for 30 days.

Update

Re-run aws cloudformation deploy with the same stack name. To deploy updated image tags, pass the new AgentImageTag / ServiceImageTag — ECS performs a rolling replacement.

warning

The Aries DIDComm Agent receives encrypted callbacks from other agents on the network and must be accessible to the internet. Protect it from DDoS and similar risks by fronting it with the public ALB provisioned by this stack.