Cloud setup guide
Instructions to setup Card Vault on AWS manually
This guide will help you to setup the card vault on AWS manually by setting up the various components
Creating EC2 instance
Log into your AWS account and create a new EC2 instance preferably on a t3.medium machine with an AMI that supports docker like Amazon Linux 2.
Ensure to manage your instances' (EC2 and RDS) security group rules are selectively enabled for the application subnet and not exposed to the internet. (The locker application should not be accessible via internet)
Install docker on the EC2 instance
Connect to your EC2 instance using the SSH client via a terminal
Once you SSH into the EC2 instance, run the following commands on the terminal to install docker
Run the following command to start docker
After starting the docker run the following command to pull the hyperswitch-card-vault
docker image
Setup Database (AWRDS)
Create an RDS with the latest
postgres
preferably withAurora
and select a storage oft4g medium
. (Record the master username and password securely for further use in setup)Ensure to add the EC2 instance to database's inbound/outbound rules and vice-versa (In the default set up the rules are set to allow all traffic)
To run the migrations install
psql
in the EC2 instance
Run the migrations using the following commands
Now, open sql interactively with the following command
and paste the contents from the below mentioned migration files
Setup KMS
Before setting up KMS, create a new IAM role for your EC2 instance to allow connection to KMS. Use AWS service
as the trusted entity type and add permissions for AWSKeyManagementServicePowerUser
and create an inline policy allowing All KMS actions
.
Now, create a KMS key pair on AWS with the key type as symmetric
and the key usage as Encrypt and Decrypt. Ensure to add the IAM role above in the key administrative permissions and key usage permissions.
Generating the keys
To generate the master key
and the custodian keys
use the following command after cloning the repository.
To generate the JWE
and JWS
keys run the following commands
We recommend generating the Master and JWE/JWS keys as mentioned below in the local setup guide outside of this EC2 machine for better security
KMS encrypting the keys
After generating your keys and setting up of KMS, run the following command to KMS encrypt the keys.
Update Config files
Create an
env-file
in the instance and paste the environment variables mentioned below
Running the Locker
After the above changes are done, run the following command to start the locker
Unlock the locker
Once the locker is up and running, use the 2 key custodian keys generated earlier securely to unlock the locker for use.
The following cURLs are to be used to provide keys
If the last cURL replies with Decrypted Successfully
, we are ready to use the locker.
Integrating it with Hyperswitch
To start using it with Hyperswitch application update the following environment variables while deploying the Hyperswitch Server. To use it with other applications use the Vault URL and JWE keys.
Last updated