Cloud (DIY): Terraform

Use the published argus-agent-fargate Terraform module from the argusdspm/deploy-argus repo to provision the same infrastructure as the Cloud (managed) Fargate template, but as part of your own Terraform stack.

When to pick this

• Terraform is already how your team manages AWS infrastructure.
• You want the agent deploy reviewed via your normal pull request flow instead of the AWS console.
• You want the argus-agent-baseline + autoscaled argus-agent-burst two-service shape (the module provisions both; the managed CloudFormation templates ship baseline-only).
• You want to pin the deploy to a specific module ref for reproducibility.

Prerequisites

• Complete Pre-flight first.
• Terraform 1.5 or newer installed locally.
• The AWS provider configured for the region you want the agent in (provider "aws" { region = "us-east-2" }). The module reads the region from the provider via data.aws_region.current, so you do not pass it as a module variable.
• The same VPC and subnet IDs as the Cloud (managed) Fargate path. A public subnet works with assign_public_ip = true; a private subnet with NAT works with the default assign_public_ip = false.
• An enrollment token.

You do not need to pre-create IAM roles, secrets, log groups, or security groups. The module creates them all.

Walkthrough

1. In a fresh directory, create a providers.tf:

   providers.tf

   terraform {
     required_version = ">= 1.5"
     required_providers {
       aws = { source = "hashicorp/aws", version = "~> 5.0" }
     }
   }
   
   provider "aws" {
     region = "us-east-2"
   }

2. Create a main.tf:

   main.tf

   module "argus_agent" {
     source = "github.com/argusdspm/deploy-argus//modules/argus-agent-fargate?ref=v0.7.7"
   
     customer_name     = "production"
     enrollment_token  = var.enrollment_token
     vpc_id            = "vpc-xxxxxxxxxxxxxxxxx"
     subnet_ids        = ["subnet-xxxxxxxxxxxxxxxxx"]
     argus_backend_url = "https://api.argusdspm.com"
   
     # true for public-subnet deploys (no NAT). Leave false for private
     # subnets that reach the internet via NAT.
     assign_public_ip = true
   
     # Default-off scanning is the baseline. Flip on per-service or
     # enable_all_datastores = true for first-deploy validation.
     enable_all_datastores = true
   }
   
   variable "enrollment_token" {
     type      = string
     sensitive = true
   }

3. Initialize and apply:

   terraform init
   terraform apply -var enrollment_token="argus_et_<your-token-here>"

   The first apply provisions about 25 resources (cluster, two services, two task definitions, IAM roles and policies, security group, Secrets Manager secret, log group, autoscaling pair). Expect 2-3 minutes.

Module variables reference

Required:

Variable	Type	Notes
customer_name	string	Names and tags every resource. Alphanumerics and hyphens only.
enrollment_token	string	Bootstrap token. Mark sensitive = true in your declaration.
vpc_id	string	VPC where the agent runs.
subnet_ids	list(string)	Subnets in that VPC. One is enough for first deploy; the module spreads tasks across whatever you list.

Commonly tuned:

Variable	Default	Notes
argus_backend_url	https://api.argusdspm.com	Override only for self-hosted Argus.
agent_image_tag	stable	Pin to v0.7.9 (or newer) for reproducibility.
aws_region	(provider region)	Optional override. By default reads from the configured provider.
assign_public_ip	false	Set true in public-subnet deploys without a NAT gateway.
enable_all_datastores	false	true scans S3 + RDS + DynamoDB + Redshift. Or set per-service flags (enable_s3_scanning, etc.).
cpu, memory	1024, 2048	Fargate task sizing.
burst_min_capacity, burst_max_capacity	0, 10	Bounds for the burst service autoscaler. The baseline service is always 1.

The full variable surface is documented in the module’s README at https://github.com/argusdspm/deploy-argus/tree/main/modules/argus-agent-fargate.

Verify

terraform output                 # cluster_name, task_role_arn, etc.

aws ecs describe-services \
  --cluster argus-agent-<customer_name> \
  --services argus-agent-<customer_name>-baseline \
  --query 'services[0].[status,runningCount]' --output text
# expect: ACTIVE 1

aws logs tail /ecs/argus-agent-<customer_name> --follow
# expect bootstrap + auth + polling messages identical to Cloud (managed) Fargate

See Verifying connection.

Teardown

terraform destroy -var enrollment_token="argus_et_<your-token-here>"

Removes all 25 resources cleanly. The Secrets Manager secret is force-deleted with no recovery window, so the same customer_name can be reused immediately.