Skip to content

Commit 4b10a07

Browse files
author
Simon Goldberg
committed
downgraded instance type, and added mainnet sample config file
1 parent afc8a74 commit 4b10a07

File tree

3 files changed

+44
-1
lines changed

3 files changed

+44
-1
lines changed

‎lib/xrp/README.md

+31
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,37 @@ XRP node deployment on AWS. All nodes are configure as ["Stock Servers"](https:/
2424
2. The XRP nodes are accessed by dApps or development tools internally through [Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html). RPC API is not exposed to the Internet to protect nodes from unauthorized access.
2525
3. The XRP nodes send various monitoring metrics for EC2 to Amazon CloudWatch.
2626

27+
## Well-Architected
28+
29+
<details>
30+
<summary>Review the for pros and cons of this solution.</summary>
31+
32+
### Well-Architected Checklist
33+
34+
This is the Well-Architected checklist for XRP nodes implementation of the AWS Blockchain Node Runner app. This checklist takes into account questions from the [AWS Well-Architected Framework](https://aws.amazon.com/architecture/well-architected/) which are relevant to this workload. Please feel free to add more checks from the framework if required for your workload.
35+
36+
| Pillar | Control | Question/Check | Remarks |
37+
|:------------------------|:----------------------------------|:---------------------------------------------------------------------------------|:-----------------|
38+
| Security | Network protection | Are there unnecessary open ports in security groups? | Please note that XRP sync ports remain open for outbound connections; Port 2459 and 51235 (TCP/UDP). |
39+
| | | Traffic inspection | AWS WAF could be implemented for traffic inspection. Additional charges will apply. |
40+
| | Compute protection | Reduce attack surface | This solution uses Amazon Linux 2 AMI. You may choose to run hardening scripts on it. |
41+
| | | Enable people to perform actions at a distance | This solution uses AWS Systems Manager for terminal session, not ssh ports. |
42+
| | Data protection at rest | Use encrypted Amazon Elastic Block Store (Amazon EBS) volumes | This solution uses encrypted Amazon EBS volumes. |
43+
| | | Use encrypted Amazon Simple Storage Service (Amazon S3) buckets | This solution uses Amazon S3 managed keys (SSE-S3) encryption. |
44+
| | Data protection in transit | Use TLS | The AWS Application Load balancer currently uses HTTP listener. Create HTTPS listener with self signed certificate if TLS is desired. |
45+
| | Authorization and access control | Use instance profile with Amazon Elastic Compute Cloud (Amazon EC2) instances | This solution uses AWS Identity and Access Management (AWS IAM) role instead of IAM user. |
46+
| | | Following principle of least privilege access | Privileges are scoped down. |
47+
| | Application security | Security focused development practices | cdk-nag is being used with appropriate suppressions. |
48+
| Cost optimization | Service selection | Use cost effective resources | AWS Graviton-based Amazon EC2 instances are being used, which are cost effective compared to Intel/AMD instances. |
49+
| Reliability | Resiliency implementation | Withstand component failures | This solution uses AWS Application Load Balancer with RPC nodes for high availability. |
50+
| | Resource monitoring | How are workload resources monitored? | Resources are being monitored using Amazon CloudWatch dashboards. Amazon CloudWatch custom metrics are being pushed via CloudWatch Agent. |
51+
| Performance efficiency | Compute selection | How is compute solution selected? | Compute solution is selected based on best price-performance, i.e. AWS Graviton-based Amazon EC2 instances. |
52+
| | Storage selection | How is storage solution selected? | Storage solution is selected based on best price-performance. |
53+
| Operational excellence | Workload health | How is health of workload determined? | Health of workload is determined via AWS Application Load Balancer Target Group Health Checks, on port 8545. |
54+
| Sustainability | Hardware & services | Select most efficient hardware for your workload | This solution uses AWS Graviton-based Amazon EC2 instances which offer the best performance per watt of energy use in Amazon EC2. |
55+
56+
</details>
57+
2758
## Setup Instructions
2859

2960
### Open AWS CloudShell

‎lib/xrp/sample-configs/.env-sample-mainnet

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
AWS_ACCOUNT_ID="xxxxxxxxxxx"
2+
AWS_REGION="xxxxxxxxxx"
3+
XRP_INSTANCE_TYPE="i3.2xlarge" #The solution was originally tested with the r7a.12xlarge instance type. Other instance types may work, but have not been extensively tested. i3.2xlarge is recommended for use by XRP Ledger
4+
XRP_CPU_TYPE="x86_64" # All options: "x86_64". ARM currently not supported
5+
DATA_VOL_TYPE="gp3" # Other options: "io1" | "io2" | "gp3" | "instance-store" . IMPORTANT: Use "instance-store" option only with instance types that support that feature, like popular for node im4gn, d3, i3en, and i4i instance families
6+
DATA_VOL_SIZE="2000" # Current required data size to keep both smapshot archive and unarchived version of it
7+
DATA_VOL_IOPS="12000" # Max IOPS for EBS volumes (not applicable for "instance-store")
8+
DATA_VOL_THROUGHPUT="700"
9+
XRP_HA_ALB_HEALTHCHECK_GRACE_PERIOD_MIN="60"
10+
XRP_HA_NODES_HEARTBEAT_DELAY_MIN="5"
11+
XRP_HA_NUMBER_OF_NODES="2"
12+
HUB_NETWORK_ID="mainnet"

‎lib/xrp/sample-configs/.env-sample-testnet

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
AWS_ACCOUNT_ID="xxxxxxxxxxx"
22
AWS_REGION="xxxxxxxxxx"
3-
XRP_INSTANCE_TYPE="r7a.12xlarge"
3+
XRP_INSTANCE_TYPE="i3.2xlarge" #The solution was originally tested with the r7a.12xlarge instance type. Other instance types may work, but have not been extensively tested. i3.2xlarge is recommended for use by XRP Ledger
44
XRP_CPU_TYPE="x86_64" # All options: "x86_64". ARM currently not supported
55
DATA_VOL_TYPE="gp3" # Other options: "io1" | "io2" | "gp3" | "instance-store" . IMPORTANT: Use "instance-store" option only with instance types that support that feature, like popular for node im4gn, d3, i3en, and i4i instance families
66
DATA_VOL_SIZE="2000" # Current required data size to keep both smapshot archive and unarchived version of it

0 commit comments

Comments
 (0)