{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/wallet/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Wallet backup configuration","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com/products/custody","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"wallet-backup-configuration","__idx":0},"children":["Wallet backup configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide provides instructions for configuring AWS S3 buckets to securely store encrypted Palisade wallet backup files. The setup ensures your encrypted recovery shards are stored with enterprise-grade security while maintaining controlled access for the Palisade MPC (Multi-Party Computation) service to write backups when needed."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This backup process works with ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/security-controls/mpc-quorums"},"children":["MPC quorums"]}," to ensure key recovery."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"architecture-overview","__idx":1},"children":["Architecture overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your S3 bucket stores encrypted wallet backups in a specific folder structure, with AWS IAM roles controlling access. The Palisade MPC service assumes a role in your AWS account to write encrypted backup files, ensuring you maintain full ownership and control of your data."]},{"$$mdtype":"Tag","name":"Mermaid","attributes":{"data-language":"mermaid","diagramSource":"flowchart LR\n subgraph palisade[\"Palisade Cloud\"]\n MPC[\"MPC Service\"]\n end\n\n subgraph customer[\"Your AWS Account\"]\n IAM[\"IAM Role
PalisadeS3BackupRole\"]\n subgraph s3[\"S3 Bucket\"]\n KMS[\"KMS Encryption\"]\n Shards[\"Recovery Shards\"]\n end\n end\n\n MPC -->|\"1. AssumeRole
(with External ID)\"| IAM\n IAM -->|\"2. PutObject
(encrypted)\"| s3\n KMS -.->|encrypts| Shards\n","diagramHtml":"

Your AWS Account

Palisade Cloud

1. AssumeRole
(with External ID)
2. PutObject
(encrypted)

S3 Bucket

encrypts

KMS Encryption

Recovery Shards

MPC Service

IAM Role
PalisadeS3BackupRole

"},"children":["flowchart LR\n subgraph palisade[\"Palisade Cloud\"]\n MPC[\"MPC Service\"]\n end\n\n subgraph customer[\"Your AWS Account\"]\n IAM[\"IAM Role
PalisadeS3BackupRole\"]\n subgraph s3[\"S3 Bucket\"]\n KMS[\"KMS Encryption\"]\n Shards[\"Recovery Shards\"]\n end\n end\n\n MPC -->|\"1. AssumeRole
(with External ID)\"| IAM\n IAM -->|\"2. PutObject
(encrypted)\"| s3\n KMS -.->|encrypts| Shards\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"data-structure","__idx":2},"children":["Data structure"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"your-backup-bucket/\n├── /\n│ ├── recovery_shard-0.txt\n│ ├── recovery_shard-1.txt\n│ └── recovery_shard-2.txt\n└── /\n ├── recovery_shard-0.txt\n └── recovery_shard-1.txt\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites-generate-recovery-key-pairs","__idx":3},"children":["Prerequisites: Generate recovery key pairs"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before setting up your backup strategy, generate RSA-4096 recovery key pairs using either the Palisade Wallet Recovery CLI (recommended) or OpenSSL."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"key-format-requirements","__idx":4},"children":["Key format requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Public key files you upload to Palisade must be:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["RSA-4096 public keys"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["DER encoded (PKIX/SubjectPublicKeyInfo format)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Either binary DER format OR hex-encoded text (auto-detected)"]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Format auto-detection"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Palisade automatically detects whether your public key file is binary DER or hex-encoded text and accepts both formats. The UI displays the detected format when you upload a file. Accepted file extensions are ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".der"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".hex"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".pem"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"option-1-using-the-palisade-wallet-recovery-cli-recommended","__idx":5},"children":["Option 1: Using the Palisade Wallet Recovery CLI (recommended)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For key generation, validation, and wallet recovery, use the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Palisade Wallet Recovery CLI"]},":"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Repository"]},": https://github.com/palisadeinc/wallet-recovery-cli"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The CLI provides commands for:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["generate-recovery-keypair"]}," - Generate RSA-4096 recovery key pairs"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["validate-private-key"]}," - Validate private key files"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["recover"]}," - Recover wallets from encrypted backups"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://github.com/palisadeinc/wallet-recovery-cli"},"children":["wallet-recovery-cli README"]}," for complete documentation."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"danger","name":"Critical: Secure your private key"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Store your private key securely. Without it, you cannot recover your wallets. Consider using a hardware security module (HSM) or secure offline storage."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"option-2-using-openssl-manual-generation","__idx":6},"children":["Option 2: Using OpenSSL (manual generation)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you cannot use the Palisade CLI, generate keys using OpenSSL:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"# Step 1: Generate an RSA-4096 private key\nopenssl genrsa -out recovery-private.pem 4096\n\n# Step 2: Extract the public key in binary DER format\nopenssl rsa -in recovery-private.pem -pubout -outform DER -out recovery-public.der\n\n# Step 3: Securely store the private key (convert to DER and optionally encrypt)\nopenssl rsa -in recovery-private.pem -outform DER -out recovery-private.der\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Upload ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["recovery-public.der"]}," (the binary DER file) to the Palisade UI. The UI auto-detects the format."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Optional hex encoding"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can optionally convert to hex-encoded format:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"xxd -p recovery-public.der | tr -d '\\n' > recovery-public.hex\n","lang":"bash"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"verify-your-key-files","__idx":7},"children":["Verify your key files"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before uploading, verify your public key file is in the correct format:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"# Check file size\nwc -c recovery-public.der\n# Expected output for binary DER: 550 recovery-public.der\n# Expected output for hex-encoded: 1100 recovery-public.der\n\n# Check file type\nfile recovery-public.der\n# Binary DER output: recovery-public.der: data\n# Hex-encoded output: recovery-public.der: ASCII text, with very long lines, with no line terminators\n\n# For binary DER, check it starts with ASN.1 SEQUENCE tag (0x30)\nxxd recovery-public.der | head -1\n# Expected: 00000000: 3082 0222 300d 0609 2a86 4886 f70d 0101 0..\"0...*.H.....\n\n# For hex-encoded, check content starts correctly\nhead -c 50 recovery-public.der\n# Expected: 30820222300d06092a864886f70d01010105000382020f00\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-create-the-s3-bucket","__idx":8},"children":["Step 1: Create the S3 bucket"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create a new S3 bucket with a descriptive name (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["company-palisade-wallet-backups"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enable versioning to protect against accidental overwrites."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create a KMS Customer Managed Key (CMK) for encryption, or use an existing one."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enable default encryption with AWS KMS (SSE-KMS):"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"BucketEncryption\": {\n \"ServerSideEncryptionConfiguration\": [\n {\n \"ServerSideEncryptionByDefault\": {\n \"SSEAlgorithm\": \"aws:kms\",\n \"KMSMasterKeyID\": \"arn:aws:kms:REGION:ACCOUNT:key/KEY-ID\"\n },\n \"BucketKeyEnabled\": true\n }\n ]\n }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":5},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Set bucket ownership and block public access:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enable \"Block Public Access\" for this bucket"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set Object ownership to \"Bucket owner enforced\" to disable ACLs"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Add a bucket policy to enforce TLS, KMS encryption, and block public access:"]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"DenyInsecureTransport\",\n \"Effect\": \"Deny\",\n \"Principal\": \"*\",\n \"Action\": \"s3:*\",\n \"Resource\": [\n \"arn:aws:s3:::your-backup-bucket\",\n \"arn:aws:s3:::your-backup-bucket/*\"\n ],\n \"Condition\": { \"Bool\": { \"aws:SecureTransport\": \"false\" } }\n },\n {\n \"Sid\": \"DenyUnencryptedObjectUploads\",\n \"Effect\": \"Deny\",\n \"Principal\": \"*\",\n \"Action\": \"s3:PutObject\",\n \"Resource\": \"arn:aws:s3:::your-backup-bucket/*\",\n \"Condition\": {\n \"StringNotEquals\": { \"s3:x-amz-server-side-encryption\": \"aws:kms\" }\n }\n },\n {\n \"Sid\": \"DenyWrongKmsKey\",\n \"Effect\": \"Deny\",\n \"Principal\": \"*\",\n \"Action\": \"s3:PutObject\",\n \"Resource\": \"arn:aws:s3:::your-backup-bucket/*\",\n \"Condition\": {\n \"StringNotEquals\": {\n \"s3:x-amz-server-side-encryption-aws-kms-key-id\": \"arn:aws:kms:REGION:ACCOUNT:key/KEY-ID\"\n }\n }\n }\n ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":7},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Configure lifecycle policies for backup retention:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"Rules\": [\n {\n \"Id\": \"RetainBackupsAndVersions\",\n \"Status\": \"Enabled\",\n \"NoncurrentVersionExpiration\": {\n \"NoncurrentDays\": 90\n },\n \"AbortIncompleteMultipartUpload\": {\n \"DaysAfterInitiation\": 7\n }\n }\n ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-create-the-iam-role-for-s3-access","__idx":9},"children":["Step 2: Create the IAM role for S3 access"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create an IAM role named ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PalisadeS3BackupRole"]}," (or similar) with the following configuration:"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"permission-policy","__idx":10},"children":["Permission policy"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AllowS3BackupWrites\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:PutObject\",\n \"s3:AbortMultipartUpload\"\n ],\n \"Resource\": \"arn:aws:s3:::your-backup-bucket/*\",\n \"Condition\": {\n \"StringEquals\": {\n \"s3:x-amz-server-side-encryption\": \"aws:kms\",\n \"s3:x-amz-server-side-encryption-aws-kms-key-id\": \"arn:aws:kms:REGION:ACCOUNT:key/KEY-ID\"\n }\n }\n },\n {\n \"Sid\": \"AllowS3BucketList\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:ListBucket\"\n ],\n \"Resource\": \"arn:aws:s3:::your-backup-bucket\"\n },\n {\n \"Sid\": \"AllowKMSEncryption\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"kms:GenerateDataKey\",\n \"kms:Encrypt\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"arn:aws:kms:REGION:ACCOUNT:key/KEY-ID\"\n },\n {\n \"Sid\": \"AllowStsGetCallerIdentity\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:GetCallerIdentity\",\n \"Resource\": \"*\"\n }\n ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"KMS permissions required"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AllowKMSEncryption"]}," statement is required for the role to encrypt objects with your KMS key."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"trust-relationship-policy","__idx":11},"children":["Trust relationship policy"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"for-sandbox-environment-appsandboxpalisadeco","__idx":12},"children":["For sandbox environment (app.sandbox.palisade.co)"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::187316130931:user/mpc-service\"\n },\n \"Action\": \"sts:AssumeRole\"\n }\n ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"for-production-environment-apppalisadeco","__idx":13},"children":["For production environment (app.palisade.co)"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::663932549156:user/mpc-service\"\n },\n \"Action\": \"sts:AssumeRole\"\n }\n ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"enhanced-security-with-external-id-optional","__idx":14},"children":["Enhanced security with External ID (optional)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For additional security, require an External ID in your trust policy. This prevents the \"confused deputy\" problem where other AWS accounts might try to assume your role."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you configure an External ID in the Palisade UI, the MPC service includes it when assuming your role. Your trust policy can then require this specific External ID:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::663932549156:user/mpc-service\"\n },\n \"Action\": \"sts:AssumeRole\",\n \"Condition\": {\n \"StringEquals\": {\n \"sts:ExternalId\": \"your-unique-external-id\"\n }\n }\n }\n ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"External ID matching"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The External ID you configure in the Palisade UI must exactly match the value in your trust policy's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["sts:ExternalId"]}," condition."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-configure-in-palisade-ui","__idx":15},"children":["Step 3: Configure in Palisade UI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After creating your S3 bucket and IAM role, configure the backup strategy in the Palisade dashboard."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Backup & Recovery"]}," and enter the following:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What to enter"},"children":["What to enter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Example"},"children":["Example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Assume Role ARN"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The ARN of the IAM role you created (NOT the bucket ARN)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam::123456789012:role/PalisadeS3BackupRole"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Bucket"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Just the bucket name (no ARN, no s3:// prefix)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["company-palisade-wallet-backups"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Region"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The AWS region where your bucket is located"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["eu-west-1"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External ID (optional)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A unique identifier for role assumption security"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["palisade-backup-2024-abc123"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["KMS Key ARN (optional)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The KMS key ARN for server-side encryption"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:kms:eu-west-1:123456789012:key/12345678-1234-1234-1234-123456789012"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Common mistake"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Do not enter the S3 bucket ARN in the \"Assume Role ARN\" field. The system expects an IAM Role ARN in the format ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam:::role/"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"pre-flight-validation","__idx":16},"children":["Pre-flight validation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you save your backup configuration, Palisade automatically validates that:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The MPC service can assume the specified IAM role"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The role has permission to write to the S3 bucket"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If an External ID is configured, it's accepted by the trust policy"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If a KMS Key ARN is configured, the role can use it for encryption"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This validation happens ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["before"]}," Palisade provisions any wallets, ensuring you discover configuration issues immediately rather than during wallet creation."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"arn-format-reference","__idx":17},"children":["ARN format reference"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Format"},"children":["Format"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Example"},"children":["Example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["IAM Role ARN (correct)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam:::role/"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam::123456789012:role/PalisadeS3BackupRole"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["S3 Bucket ARN (incorrect)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:s3:::"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:s3:::my-bucket"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["KMS Key ARN"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:kms:::key/"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:kms:eu-west-1:123456789012:key/..."]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-advanced-security-configuration-optional","__idx":18},"children":["Step 4: Advanced security configuration (optional)"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"enable-cloudtrail-logging","__idx":19},"children":["Enable CloudTrail logging"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"EventSelectors\": [\n {\n \"ReadWriteType\": \"All\",\n \"IncludeManagementEvents\": false,\n \"DataResources\": [\n {\n \"Type\": \"AWS::S3::Object\",\n \"Values\": [\"arn:aws:s3:::your-backup-bucket/*\"]\n }\n ]\n }\n ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configure-s3-object-lock-for-immutable-backups","__idx":20},"children":["Configure S3 Object Lock (for immutable backups)"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"ObjectLockEnabled\": \"Enabled\",\n \"Rule\": {\n \"DefaultRetention\": {\n \"Mode\": \"COMPLIANCE\",\n \"Days\": 30\n }\n }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-best-practices-checklist","__idx":21},"children":["Security best practices checklist"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Encryption at rest"]},": Default SSE-KMS with your CMK enforced at bucket and IAM policy"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Encryption in transit"]},": Bucket policy enforces SSL/TLS connections"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access control"]},": IAM role with minimal required permissions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["KMS permissions"]},": Role has ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kms:GenerateDataKey"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kms:Encrypt"]}," on your CMK"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External ID"]},": Configure an External ID for enhanced role assumption security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Versioning"]},": Enabled to protect against accidental overwrites"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Logging"]},": CloudTrail and S3 access logging enabled"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Monitoring"]},": CloudWatch alarms configured"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Backup retention"]},": Lifecycle policies configured"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"input","attributes":{"checked":false,"type":"checkbox","readOnly":true},"children":[]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MFA Delete"]},": Consider enabling for production buckets"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":22},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"access-denied-errors","__idx":23},"children":["Access denied errors"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Trust relationship missing Palisade account"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add correct Palisade account ID to trust policy"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["S3 bucket name mismatch"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ensure bucket name in policies matches exactly"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing KMS permissions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add required KMS permissions to IAM role"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["External ID mismatch"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify External ID matches between UI and trust policy"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"encryption-errors","__idx":24},"children":["Encryption errors"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["SSE not enabled on bucket"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enable server-side encryption on the bucket"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bucket policy missing encryption requirement"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add policy requiring encrypted uploads"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing KMS permissions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kms:GenerateDataKey"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kms:Encrypt"]}," to IAM role"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["KMS Key ARN mismatch"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ensure KMS Key ARN in UI matches bucket policy"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"role-assumption-failures","__idx":25},"children":["Role assumption failures"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Wrong principal ARN"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify principal matches environment (Sandbox vs Production)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["External ID not configured"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Configure External ID in both Palisade UI and trust policy"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unknown error"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check CloudTrail logs for detailed error messages"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"invalid-arn-format-in-palisade-ui","__idx":26},"children":["Invalid ARN format in Palisade UI"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entered S3 bucket ARN instead of IAM role ARN"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use IAM Role ARN format: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam:::role/"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Invalid characters in role name"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use only alphanumeric characters and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["+=,.@_-"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"pre-flight-validation-failures","__idx":27},"children":["Pre-flight validation failures"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When saving a backup configuration, you may see validation errors:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Error"},"children":["Error"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["\"Failed to assume role\""]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Trust policy doesn't allow Palisade MPC service"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check trust policy principal ARN"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["\"External ID mismatch\""]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["External ID in UI doesn't match trust policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ensure External IDs match exactly"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["\"Access denied to bucket\""]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Role lacks S3 permissions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check IAM role permission policy"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["\"KMS key access denied\""]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Role lacks KMS permissions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kms:GenerateDataKey"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kms:Encrypt"]}," to role"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"public-key-validation-errors","__idx":28},"children":["Public key validation errors"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"invalid-format-or-file-rejected-on-upload","__idx":29},"children":["Invalid format or file rejected on upload"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The UI validates public key files on upload. Common causes of rejection:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["File is not a valid DER-encoded public key"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ensure the file is RSA-4096 in DER format (PKIX/SubjectPublicKeyInfo)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["File is PEM format with headers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use DER format, not PEM. Remove ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["-----BEGIN PUBLIC KEY-----"]}," headers"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["File contains invalid characters"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["For hex-encoded files, ensure only hex characters (0-9, a-f)"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"key-too-small-or-key-rejected-after-upload","__idx":30},"children":["Key too small or key rejected after upload"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This error means your public key is smaller than RSA-4096. Common causes:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Solution"},"children":["Solution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Used RSA-2048 or smaller key size"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Generate RSA-4096 keys"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["File was truncated during transfer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Re-generate or re-download the key file"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"quick-diagnostic","__idx":31},"children":["Quick diagnostic"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Run this command to check your key file:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"file your-public-key.der && wc -c your-public-key.der\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Expected output for valid RSA-4096 keys:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"# Binary DER format (550 bytes):\nyour-public-key.der: data\n550 your-public-key.der\n\n# Hex-encoded format (1100 characters):\nyour-public-key.der: ASCII text, with very long lines, with no line terminators\n1100 your-public-key.der\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"wallet-recovery-process","__idx":32},"children":["Wallet recovery process"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For complete wallet recovery instructions, see the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Palisade Wallet Recovery CLI"]}," documentation:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Repository"]},": https://github.com/palisadeinc/wallet-recovery-cli"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The recovery process involves:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Downloading the encrypted backup from your S3 bucket"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Using the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["recover"]}," command with your recovery private key"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Securely handling the recovered wallet private key"]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"danger","name":"Critical: Handle recovered keys with care"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The recovered private key can irrevocably sign transactions affecting assets held by that wallet. Handle with extreme care and follow your organization's key management policies."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"appendix-quick-reference","__idx":33},"children":["Appendix: Quick reference"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"palisade-aws-account-ids","__idx":34},"children":["Palisade AWS account IDs"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Environment"},"children":["Environment"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Account ID"},"children":["Account ID"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"MPC Service Principal"},"children":["MPC Service Principal"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Sandbox"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["187316130931"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam::187316130931:user/mpc-service"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Production"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["663932549156"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam::663932549156:user/mpc-service"]}]}]}]}]}]}]},"headings":[{"value":"Wallet backup configuration","id":"wallet-backup-configuration","depth":1},{"value":"Architecture overview","id":"architecture-overview","depth":2},{"value":"Data structure","id":"data-structure","depth":3},{"value":"Prerequisites: Generate recovery key pairs","id":"prerequisites-generate-recovery-key-pairs","depth":2},{"value":"Key format requirements","id":"key-format-requirements","depth":3},{"value":"Option 1: Using the Palisade Wallet Recovery CLI (recommended)","id":"option-1-using-the-palisade-wallet-recovery-cli-recommended","depth":3},{"value":"Option 2: Using OpenSSL (manual generation)","id":"option-2-using-openssl-manual-generation","depth":3},{"value":"Verify your key files","id":"verify-your-key-files","depth":3},{"value":"Step 1: Create the S3 bucket","id":"step-1-create-the-s3-bucket","depth":2},{"value":"Step 2: Create the IAM role for S3 access","id":"step-2-create-the-iam-role-for-s3-access","depth":2},{"value":"Permission policy","id":"permission-policy","depth":3},{"value":"Trust relationship policy","id":"trust-relationship-policy","depth":3},{"value":"For sandbox environment (app.sandbox.palisade.co)","id":"for-sandbox-environment-appsandboxpalisadeco","depth":4},{"value":"For production environment (app.palisade.co)","id":"for-production-environment-apppalisadeco","depth":4},{"value":"Enhanced security with External ID (optional)","id":"enhanced-security-with-external-id-optional","depth":3},{"value":"Step 3: Configure in Palisade UI","id":"step-3-configure-in-palisade-ui","depth":2},{"value":"Pre-flight validation","id":"pre-flight-validation","depth":3},{"value":"ARN format reference","id":"arn-format-reference","depth":3},{"value":"Step 4: Advanced security configuration (optional)","id":"step-4-advanced-security-configuration-optional","depth":2},{"value":"Enable CloudTrail logging","id":"enable-cloudtrail-logging","depth":3},{"value":"Configure S3 Object Lock (for immutable backups)","id":"configure-s3-object-lock-for-immutable-backups","depth":3},{"value":"Security best practices checklist","id":"security-best-practices-checklist","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Access denied errors","id":"access-denied-errors","depth":3},{"value":"Encryption errors","id":"encryption-errors","depth":3},{"value":"Role assumption failures","id":"role-assumption-failures","depth":3},{"value":"Invalid ARN format in Palisade UI","id":"invalid-arn-format-in-palisade-ui","depth":3},{"value":"Pre-flight validation failures","id":"pre-flight-validation-failures","depth":3},{"value":"Public key validation errors","id":"public-key-validation-errors","depth":3},{"value":"Invalid format or file rejected on upload","id":"invalid-format-or-file-rejected-on-upload","depth":4},{"value":"Key too small or key rejected after upload","id":"key-too-small-or-key-rejected-after-upload","depth":4},{"value":"Quick diagnostic","id":"quick-diagnostic","depth":4},{"value":"Wallet recovery process","id":"wallet-recovery-process","depth":2},{"value":"Appendix: Quick reference","id":"appendix-quick-reference","depth":2},{"value":"Palisade AWS account IDs","id":"palisade-aws-account-ids","depth":3}],"frontmatter":{"title":"Wallet backup configuration","seo":{"title":"Wallet backup configuration"}},"lastModified":"2026-02-27T16:34:32.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/wallet/user-interface/security-controls/wallet-backup-configuration","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}