Skip to content

AWS ECS

Jump to bottom
Eero Vahteri edited this page May 19, 2025 · 2 revisions

High-level diagram of the setup

eidas broker setup diagram

Resources used

  • ECS
  • Fargate
  • Secrets Manager
  • S3
  • EFS
  • DataSync
  • VPC
  • IAM

Uploading server certificates to AWS

  1. Create certificates for client - broker interaction using the guide in the documentation.
  2. Create a new S3 bucket and upload the directory /broker_tls containing the certificate and key files to the bucket.
  3. Create a new EFS in the same VPC that you are planning to run eIDAS broker in. Use recommended settings.
  4. Go to your EFS > Network and check the security group. Edit the security group settings to allow EFS inbound traffic: EC2 > Security Groups > your security group > Edit inbound rules:
    • Type: NFS
    • Protocol: TCP
    • Port range: 2049
    • Description: "fargate efs connection", for example
  5. To move certificates from S3 to EFS for Fargate to use them, create a new DataSync task:
    • Go to DataSync > Locations > Create location
      • Location type: S3
      • S3 URI: go to the S3 bucket containing broker_tls directory, select directory and choose copy S3 URI, then paste to this field
      • IAM role: Autogenerate
      • Press Create location
    • Go to DataSync > Locations > Create location
      • Location type: Amazon EFS file system
      • Choose the EFS created earlier
      • Subnet: Any
      • Security groups: You can choose default or create a new one. Make sure to use the same group in later stages for ECS and Load balancer.
      • Press Create location
  6. Go to DataSync > Tasks > Create task
    • Source location options:
      • Choose an existing location
      • Choose the S3 location created earlier
    • Destination location options:
      • Choose an existing location
      • Choose the EFS location created earlier
    • Name: eidas-broker-s3-to-efs (for example)
    • Source data options: default
    • Transfer options: default
    • Schedule: Not scheduled
    • Task report: None
    • Logging: default, Autogenerate CloudWatch log group if not existing
  7. Go to DataSync > Tasks > your task > Start > Start with defaults (This will upload the files to EFS)

Storing open banking certificates and keys

Check project README to see which certificates need to be available. Storing keys and certificates in Secrets Manager allows for adding new certificates to the eidas broker and makes storing them safe. Check pricing here: https://aws.amazon.com/secrets-manager/pricing/

  • Secret type: Other type of secret
  • Key/value pairs:
    • Choose Plaintext
    • Paste your certificate/key (Make sure the format is PEM and newlines are intact)
    • Press next
  • Secret name and description: Choose freely

ECS Task definition

On AWS console, go to ECS > Task definitions > Create new task definition

  • Task definition configuration
    • Name: eidas-broker (for example)
  • Infrastructure requirements
    • Launch type: AWS Fargate
    • Operating system/Architecture: Linux/x86_64
    • Task size
      • CPU: .25 CPU
      • Memory: .5 GB
    • Task roles: default
  • Container -1

    • Container details

      • Name: eidas-broker
      • Image URI: ghcr.io/enablebanking/eidas_broker:latest
      • Essential container: Yes

    • Port mappings

      • 1
        • Container port: 443
        • Protocol: TCP
        • Port name: eidas-broker-443-tcp
      • 2
        • Container port: 80
        • Protocol: TCP
        • Port name: eidas-broker-80-tcp

    • Environment variables

      Disclaimer: You can name the certificate values as you wish, but they have the _CRED suffix. When uploading new certificates for renewal, keep the old ones intact and name the new certificate something unique (for example QWAC_2025_CRT_CRED).

      • 1
        • Key: KEY_LOADER
        • Value type: Value
        • Value: ENV
      • 2
        • Key: QSEALC_CRT_CRED
        • Value type: ValueFrom
        • Value: {Secret ARN of the QsealC secret}
      • 3
        • Key: QSEALC_KEY_CRED
        • Value type: ValueFrom
        • Value: {Secret ARN of the Qseal key secret}
      • 4
        • Key: QWAC_CRT_CRED
        • Value type: ValueFrom
        • Value: {Secret ARN of the QWAC secret}
      • 5
        • Key: QWAC_KEY_CRED
        • Value type: ValueFrom
        • Value: {Secret ARN of the QWAC key secret}

    • Log collection (Based on your preference)

      • Use log collection: True
      • Otherwise default values are enough

    • Storage

      • Volume -1
        • Volume name: efs-volume (for example)
        • Configuration type: Configure at task definition creation
        • Volume type: EFS
        • File system ID: Choose the EFS created earlier
        • Root directory: /
        • Access point ID: None
      • Container mount points
        • Container: Choose the eIDAS broker container
        • Source volume: EFS volume created earlier
        • Container path: /app/broker_tls

Rest of the settings can be kept as default

Press Create

Set task execition role with necessary permissions

Go to IAM > Roles > ecsTaskExecutionRole > Add permissions > Attach policies

Add SecretManagerReadWrite

Load balancer

Go to EC2 > load balancers > Target groups > Create target group

  • Target type: IP addresses
  • Target group name: eidas-broker-tg (for example)
  • Protocol: ICP
  • Port: 443
  • VPC: Choose the VPC you are planning to run the eIDAS broker in
  • Protocol version: HTTP1

Press Create target Group

Go to EC2 > load balancers > Create load balancer

Choose Network Load Balancer

  • Load balancer name: eidas-broker-lb (for example)
  • Scheme: Internet facing
  • Load balancer IP address type: IPv4
  • Network mapping:
    • VPC: Choose VPC where you are planning to run eIDAS broker
    • Availability Zones and subnets: Choose relevant for your VPC, you can choose all of them to ensure fault tolerance
  • Security groups: Select the one you used in EFS
  • Listeners:
    • Add new one:
      • Protocol: TCP
      • Port: 443
      • Target group: the one created in earlier step (eidas-broker-tg)

Press Create load balancer

Service setup - ECS cluster

Note: You can use your existing cluster if the infrastructure supports the described setup (Fargate instances)

Go to Amazon Elastic Container Service > Clusters > Create cluster

  • Cluster name: eidas-broker-cluster (for example)
  • Infrastructure: AWS Fargate

Press Create

Go to your cluster > Services > Create

  • Task definition family: eidas-broker
  • Networking:
    • Choose your VPC and subnet
    • Select the same security group as for the Load Balancer
  • Load balancing
    • Check use load balancing
    • Choose your VPC
    • Load balancer type: Network Load Balancer
    • Choose the LB created earlier
    • Use an existing listener: TCP:443
    • Target group: Choose the existing target group

Press Create

Security group

We need to adjust the security group that Load balancer and ECS task uses to allow for inbound traffic from the IP where Enable Banking will access it.

  1. Go to EC2 > Security Groups
  2. Select the security group used in the services
  3. Select inbound rules > Edit inbound rules
  4. Add new inbound rule:
    • Type: HTTPS
    • Protocol: TCP
    • Port range: 443
    • Source: Custom
    • Add address <IP_from_Enable_Banking>/32

Sharing access with Enable Banking API

Now everything should be up and running. You can get the public DNS address of the eIDAS broker from EC2 > Load balancers > eidas-broker-lb, under the DNS name. Share this with Enable Banking as well as the aliases for the certificate and key environment values.

Updating open banking certificates

When your open banking certificates expire, you will need to make sure new ones are available in the eIDAS broker alongside the old ones.

  1. Go to Secrets Manager
  2. Add a new secret
    • Secret type: Other type of secret
    • In the Plaintext, paste your certificate/key, make sure newlines are kept intact
    • Secret name: free to choose
    • Copy Secret ARN to clipboard
  3. In ECS, edit current task definition
    • Create new revision
    • Add new Environment variable with key naming that ends in _CRED, like QWAC_2025_CRT_CRED, Valuetype ValueFrom and paste Secret ARN to Value field
  4. Repeat to all new certificates/keys and create revision
  5. Restart current ECS task with the new revision version

Updating eidas broker version

ECS > Clusters > your cluster > Services > eidas broker service > Update service > Force new deployment.

Because the :latest tag is used, the new deployment will run the release version of eIDAS broker image.

Updating server certificates

  1. Upload new versions to the S3 bucket containing the current ones and re-run the DataSync task to update the EFS.
  2. ECS > Clusters > your cluster > Services > eidas broker service > Update service > Force new deployment.

Clone this wiki locally