Encryption Service Deployment on AWS for Group Provisioning

Introduction

This article explains how to deploy the Encryption Service on AWS to enable group provisioning in NordPass. The Encryption Service allows NordPass to maintain its zero-knowledge architecture while synchronizing groups from your identity provider.

Before you start:

• The user provisioning must already be enabled
• You need to have an active AWS account

Here's what to do

1. Log in to the NordPass Business Admin Panel.
2. Go to “Integrations”.
3. Select your identity provider.
4. If user provisioning is not configured, follow the setup guide for the selected identity provider.
5. Click "Create Configuration".
6. Select "AWS" as the cloud provider for the Encryption Service deployment.
7. Copy and save the generated configuration. You will need it later.
8. Log in to Amazon Web Services (AWS).
9. Open “Services” and select “Elastic Container Service (ECS)”.
10. Open “Task definitions”.
11. Select "Create new task definition" → "Create new task definition with JSON".
12. Paste the configuration copied from the NordPass Admin Panel.
13. Click "Create".
14. From the side menu, select "Clusters" and click "Create cluster".
15. Enter a cluster name (we recommend "NordPass").
16. Open the newly created cluster.
17. Go to the Services tab and click "Create".
18. Select a task family.
19. Enter a service name (we recommend "NordPass-Group-Provisioning").
20. Click "Create" to start the deployment.
21. Wait until the deployment is completed and the service status changes to "Active".
22. Return to the NordPass Business Admin Panel.
23. Confirm that the group provisioning status is shown as "Active".

Additional tips

• Ensure the Encryption Service remains running to avoid interruptions in group provisioning.
• If the group provisioning status does not become active, verify that the AWS service is running and correctly configured.
• Any changes to user groups in your identity provider will sync only while the Encryption Service is active.