Cloud (managed): EC2

The same one-click CloudFormation path as Fargate, but runs the agent on a single EC2 instance under systemd instead of as a Fargate task. Simpler mental model with SSH (or Session Manager) shell access, at the cost of operating a host (patching, AMI updates) and giving up Fargate’s built-in autoscale.

When to pick this

• You prefer a single long-lived VM over an ECS service.
• You want SSH (or Session Manager) shell access for debugging.
• You are evaluating Argus and want the cheapest possible always-on shape.
• Your platform team standardizes on EC2 and is averse to adding ECS.

Prerequisites

• Complete Pre-flight first.
• A VPC and subnet with internet access (same rules as Fargate).
• Optional: an existing EC2 key pair if you want SSH. Leave blank to skip SSH; the instance role includes AmazonSSMManagedInstanceCore so you can always shell in with Session Manager.
• An enrollment token.

Walkthrough

Option A - via the dashboard drawer

1. In the Argus dashboard, click Deploy agent.
2. Pick the Cloud (managed) shape.
3. Switch from the Fargate tab to the EC2 tab.
4. Copy the enrollment token from the credential card.
5. Click Launch CloudFormation Stack to open the AWS form.
6. Fill in:
   • EnrollmentToken: paste from step 4.
   • VpcId and SubnetId: pick yours.
   • KeyName: leave blank to skip SSH (Session Manager still works), or pick a key pair for SSH access.
   • InstanceType: t3.medium is the default and is enough for most accounts.
7. Acknowledge IAM creation and click Create stack.
8. The stack waits for the instance’s UserData to finish via cfn-signal, so CREATE_COMPLETE actually means “agent is running”, not just “EC2 booted”. Expect 3-7 minutes including AMI boot, docker install, and image pull.

Option B - via the AWS CLI

aws cloudformation create-stack \
  --region us-east-2 \
  --stack-name argus-agent-ec2 \
  --template-url https://api.argusdspm.com/downloads/argus-managed-ec2-v1.yml \
  --capabilities CAPABILITY_IAM \
  --parameters \
    ParameterKey=EnrollmentToken,ParameterValue='argus_et_<your-token-here>' \
    ParameterKey=VpcId,ParameterValue=vpc-xxxxxxxxxxxxxxxxx \
    ParameterKey=SubnetId,ParameterValue=subnet-xxxxxxxxxxxxxxxxx

KeyName is optional; omit the parameter to skip SSH.

Parameters reference

Parameter	Default	Notes
EnrollmentToken	(required)	Bootstrap token. Stored as an AWS Secrets Manager SecureString.
VpcId	(required)	VPC where the agent runs.
SubnetId	(required)	Subnet in that VPC. Must reach the internet.
KeyName	(empty)	Optional EC2 key pair for SSH. Leave blank to skip; Session Manager still works.
InstanceType	t3.medium	Allowed: t3.small, t3.medium, t3.large, t3.xlarge.
ArgusBackendUrl	https://api.argusdspm.com	Override only for self-hosted Argus.
AgentImage	ghcr.io/argusdspm/argus-agent:stable	Pin a specific version for reproducibility.

What gets deployed

• IAM instance role with the discovery policy plus AmazonSSMManagedInstanceCore for Session Manager.
• IAM instance profile wrapping the role.
• Security group (egress 443 + DNS only).
• AWS Secrets Manager secret holding the enrollment token.
• CloudWatch log group (/argus-agent/<stack-name>, 30-day retention).
• EC2 instance (Amazon Linux 2 latest AMI via SSM lookup, so it works in every region without a per-region AMI mapping).
• A systemd unit argus-agent.service that runs the agent container, bind-mounting /var/lib/argus so the per-container API key survives container restarts.

Verify

The drawer’s progress strip flips green within 4-7 minutes (slower than Fargate because UserData runs sequentially: dnf install docker, docker pull, container start). From AWS:

# cfn-signal proves UserData ran cleanly:
aws cloudformation describe-stacks \
  --stack-name argus-agent-ec2 \
  --query 'Stacks[0].StackStatus' --output text
# expect: CREATE_COMPLETE

# Shell in via Session Manager (no SSH key needed):
aws ssm start-session --target i-xxxxxxxxxxxxxxxxx
# then on the box:
systemctl status argus-agent.service
docker logs argus-agent

The container logs show the same bootstrap sequence as the Fargate path. See Verifying connection.

Teardown

aws cloudformation delete-stack --stack-name argus-agent-ec2

If you created an EC2 key pair just for this deploy, also:

aws ec2 delete-key-pair --key-name <your-key-name>