Hyperledger Besu Banking Platform - ERC-3643 & Open Banking

To launch this product, subscribe and continue to configuration from the AWS Marketplace listing, accept the terms, then select your region, instance type, and key pair before launching the included CloudFormation template. m7i.2xlarge is the recommended instance type for this x86_64 version, with m7i.xlarge also supported. All services start automatically and are typically ready within about 8 minutes, which you can confirm by watching the EC2 system log for the line "[platform-agent] Listening on :3000". Alternatively, on a self-managed Amazon Linux 2023 or Ubuntu 22.04 instance, you can run the bundled one-line installer with the --flavour=banking option instead of using CloudFormation.

Once running, the instance exposes several services: Hyperledger Besu's JSON-RPC on port 8545 (WebSocket on 8546) and P2P on port 30303; a read-only platform agent REST API on port 3000 with health, workflow, module, and connector endpoints; and an Open Banking API, implemented as a sandbox UK OBIE-style service that is not OBIE-certified, reachable directly on port 8090 or through the Kong and Keycloak API gateway on port 8443 with OAuth2/OIDC protection (mTLS client-certificate support requires upgrading to Kong Enterprise). Prometheus-format metrics are available for Besu on port 9545 and for the host on port 9100, though no Prometheus or Grafana server is bundled on the instance itself; host metrics and the Besu, Teku, and initialization logs are shipped automatically to Amazon CloudWatch.

The Open Banking API key is generated automatically on first boot and written to /opt/besu/keys/ob-api-key, readable with sudo; every endpoint except the health check requires this key as a bearer token. If the stack is launched with DeployTokenAtGenesis set to true, the ERC-3643 security-token suite deploys automatically at first boot, with the resulting token and identity-registry addresses written to /tmp/token_address and /tmp/identity_registry_address; otherwise the contracts can be deployed manually using the bundled Hardhat scripts. The platform agent also serves 13 read-only banking workflow template definitions, covering processes such as KYC onboarding, SWIFT payments, delivery-versus-payment settlement, redemptions, rights issues, sanctions freezes, forced transfers, position reconciliation, governance proposals, token pausing, and supply audits; these are definitions only, since executing them requires a workflow runtime that is not bundled, and the connectors they reference (for systems such as SWIFT, RTGS, Murex, Temenos, and Chainalysis) must also be supplied separately.

For security, restrict inbound access to the Besu RPC port and the API gateway to trusted networks rather than opening them broadly, use an IAM instance profile for CloudWatch log shipping instead of static credentials, rotate the Besu engine JWT periodically using the bundled rotate-jwt.sh script, and enable KMS encryption on the data volume along with AWS GuardDuty on the account running this instance.