Cloud (managed): EC2

The same one-click CloudFormation path as Fargate, but runs the agent on a single EC2 instance under systemd instead of as a Fargate task. Simpler mental model with SSH (or Session Manager) shell access, at the cost of operating a host (patching, AMI updates) and giving up Fargate’s built-in autoscale.

What this stack does and does not do

By default it opens no inbound ports: shell access is via Session Manager, and SSH is off unless you explicitly opt in with both a key pair and a source CIDR. It creates no role Argus can assume: the instance role trusts ec2.amazonaws.com in your own account, never an Argus principal. Your credentials never leave your account. The full resource-by-resource list is in What gets created in your account.

When to pick this

• You prefer a single long-lived VM over an ECS service.
• You want SSH (or Session Manager) shell access for debugging.
• You are evaluating Argus and want the cheapest possible always-on shape.
• Your platform team standardizes on EC2 and is averse to adding ECS.

Prerequisites

• Complete Pre-flight first.
• A VPC and subnet with internet access (same rules as Fargate).
• Optional: SSH access. It is off by default and needs two parameters together, an existing EC2 key pair in KeyName and a source CIDR in SSHAllowedCidr (for example 203.0.113.4/32). Supplying only one does nothing: a key pair with no CIDR has no route in, and a CIDR with no key pair has nothing to authenticate against. Leave both blank, which is the recommended posture, and the stack opens no inbound port at all. The instance role includes AmazonSSMManagedInstanceCore, so you can always shell in with Session Manager without a key pair or an open port.
• An enrollment token.

Walkthrough

Option A - via the dashboard drawer

1. In the Argus dashboard, click Deploy agent.
2. Pick the Cloud (managed) shape.
3. Switch from the Fargate tab to the EC2 tab.
4. Copy the enrollment token from the credential card.
5. Click Launch CloudFormation Stack to open the AWS form.
6. Fill in:
   • EnrollmentToken: paste from step 4.
   • VpcId and SubnetId: pick yours.
   • KeyName and SSHAllowedCidr: leave both blank to skip SSH entirely (Session Manager still works, and no inbound port is opened). To enable SSH you must set both: a key pair and the source CIDR allowed to reach port 22.
   • InstanceType: t3.medium is the default and is enough for most accounts.
7. Acknowledge IAM creation and click Create stack.
8. The stack waits for the instance’s UserData to finish via cfn-signal, so CREATE_COMPLETE actually means “agent is running”, not just “EC2 booted”. Expect 3-7 minutes including AMI boot, docker install, and image pull.

Option B - via the AWS CLI

aws cloudformation create-stack \
  --region us-east-2 \
  --stack-name argus-agent-ec2 \
  --template-url https://api.argusdspm.com/downloads/argus-managed-ec2-v1.yml \
  --capabilities CAPABILITY_IAM \
  --parameters \
    ParameterKey=EnrollmentToken,ParameterValue='argus_et_<your-token-here>' \
    ParameterKey=VpcId,ParameterValue=vpc-xxxxxxxxxxxxxxxxx \
    ParameterKey=SubnetId,ParameterValue=subnet-xxxxxxxxxxxxxxxxx

KeyName and SSHAllowedCidr are both optional and only do anything together. Omit them to skip SSH and leave the security group with no inbound rules. To enable it, add both:

    ParameterKey=KeyName,ParameterValue=my-keypair \
    ParameterKey=SSHAllowedCidr,ParameterValue=203.0.113.4/32

Parameters reference

Parameter	Default	Notes
EnrollmentToken	(required)	Bootstrap token. Stored as an AWS Secrets Manager SecureString.
VpcId	(required)	VPC where the agent runs.
SubnetId	(required)	Subnet in that VPC. Must reach the internet.
KeyName	(empty)	Optional EC2 key pair for SSH. Has no effect without SSHAllowedCidr. Leave blank to skip; Session Manager still works.
SSHAllowedCidr	(empty)	Optional source CIDR allowed to reach port 22, for example 203.0.113.4/32. Has no effect without KeyName. Blank means no inbound rule is created at all.
InstanceType	t3.medium	Allowed: t3.small, t3.medium, t3.large, t3.xlarge.
ArgusBackendUrl	https://api.argusdspm.com	Override only for self-hosted Argus.
AgentImage	ghcr.io/argusdspm/argus-agent:stable	Pin a specific version for reproducibility.
EnableRemediation	false	Grant Argus write access so it can FIX what it finds. Off by default: the default deployment can inspect the account but cannot change anything in it. Turn on at launch or later by updating the stack; the agent is not replaced and needs no re-enrolling. See IAM permissions.

What gets deployed

• IAM instance role with the discovery policy plus AmazonSSMManagedInstanceCore for Session Manager.
• IAM instance profile wrapping the role.
• Security group (egress 443 + DNS only).
• AWS Secrets Manager secret holding the enrollment token.
• CloudWatch log group (/argus-agent/<stack-name>, 30-day retention).
• EC2 instance (Amazon Linux 2 latest AMI via SSM lookup, so it works in every region without a per-region AMI mapping).
• A systemd unit argus-agent.service that runs the agent container, bind-mounting /var/lib/argus so the per-container API key survives container restarts.
• On the default rolling :stable image only: a weekly refresh cron on the instance (/etc/cron.weekly/argus-agent-refresh) that pulls the image and restarts the service only when the digest actually changed, keeping a stable deploy current without a redeploy. It lives inside the instance, so it is not an extra AWS resource. Pinned deploys skip it and never auto-update.

Verify

The drawer’s progress strip flips green within 4-7 minutes (slower than Fargate because UserData runs sequentially: dnf install docker, docker pull, container start). From AWS:

# cfn-signal proves UserData ran cleanly:
aws cloudformation describe-stacks \
  --stack-name argus-agent-ec2 \
  --query 'Stacks[0].StackStatus' --output text
# expect: CREATE_COMPLETE

# Shell in via Session Manager (no SSH key needed):
aws ssm start-session --target i-xxxxxxxxxxxxxxxxx
# then on the box:
systemctl status argus-agent.service
docker logs argus-agent

The container logs show the same bootstrap sequence as the Fargate path. See Verifying connection.

Teardown

aws cloudformation delete-stack --stack-name argus-agent-ec2

If you created an EC2 key pair just for this deploy, also:

aws ec2 delete-key-pair --key-name <your-key-name>