Aller au contenu principal

DuoKey on AWS

The same layout as on Azure, with the AWS service that plays each role: a private EKS cluster across three Availability Zones, RDS for PostgreSQL and Secrets Manager in private subnets, and key custody outside AWS.

Sample landscape

This maps each component of the reference architecture to its AWS equivalent. Validate it with DuoKey engineering for your account, region and volumes before sizing.

Sample landscape

DuoKey on AWS, every component

DuoKey on AWS, sample landscapeClients reach an ALB with AWS WAF and a network load balancer; the Cockpit runs on a private EKS cluster with RDS for PostgreSQL, Secrets Manager and S3 backups; keys stay with MPC nodes in separate trust domains.AWS · YOUR ACCOUNT · ONE REGION, 3 AZEDGE AND NETWORKEKS PRIVATE CLUSTER · 3 AZPRIVATE SUBNETS · VPC ENDPOINTSKEY CUSTODYUsers, Microsoft 365DKE, KMS and API clientsKMIP clientsStorage arrays, databasesYour operatorsSSO and MFADuoKey releasesImages by digestYour Git repositoryHelm values, TerraformAWS IAMSSO, pod rolesCloudWatchLogs, metrics, alarmsAWS KMSAt-rest keys onlyALB + AWS WAFHTTPS entryNetwork LBKMIP TCP 5696NAT + FirewallEgress allow-listDirect Connector Site-to-Site VPNAmazon ECRYour registry›kCockpit frontendSingle-page app›kCockpit APIDKE, KMS, KMIP, PKIArgo CDGitOps, one appExternal SecretsEKS Pod IdentityElastiCache (Redis)Optional shared cacheRDS for PostgreSQLMulti-AZ, private onlyS3 + AWS BackupBackups, object lockSecrets ManagerBoot secrets, or OpenBao›kMPC node AKey share, in this cloud›kMPC node BYour data centre›kMPC node CThird trust domainSecurosys HSMOptional hardware rootThe Software Vault is built in.MPC and HSM are optional backends.11223456789HOW TO READ THIS FIGUREDuoKey componentCloud or partner serviceOptional1Clients reach the ALB and the NLB, the only public entry2HTTPS goes to the frontend and API, KMIP TCP to the API3The API uses PostgreSQL over a private endpoint4The API reaches its key custody backend over mutual TLS5External Secrets reads Secrets Manager with workload identity6Argo CD applies the Helm values from your Git repository7DuoKey images are imported by digest into your ECR8Operators come in over Direct Connect or VPN, with SSO and MFA9MPC nodes in separate trust domains use mutual TLS

Only the ALB and the Network Load Balancer are public. AWS KMS encrypts RDS, S3 and the EBS volumes at rest; customer root keys stay with the Software Vault, the MPC nodes or the HSM.

Choices to make​

  • Platform secrets. Secrets Manager read by External Secrets with EKS Pod Identity, or OpenBao on EKS, identical to the on-premise deployment.
  • KMIP clients. Expose the Network Load Balancer publicly, or only inside your VPC and over Direct Connect or VPN.
  • Key custody per customer segment. The DuoKey MPC KMS with nodes in separate trust domains, a Securosys HSM, or both.
  • Region. One region with three Availability Zones, and a second region for disaster recovery if required.