Cloud (managed): Fargate

A one-click CloudFormation deploy that runs the agent as an ECS Fargate service inside the AWS account being scanned. AWS provisions everything: ECS cluster, IAM roles, security group, Secrets Manager secret, log group, task definition, and a Fargate service with desired_count=1.

When to pick this

• You want production-shaped infra (managed compute, no host to patch).
• You want the option to scale out later (the Fargate service is the natural starting point for burst-autoscale).
• You do not need shell access to the agent runtime (aws ecs execute-command is available if you ever do).

Prerequisites

• Complete Pre-flight first.
• A VPC (the default VPC in any region works for first-deploy validation).
• A subnet with a path to the internet, one of:
  • Public subnet with MapPublicIpOnLaunch=true. Set AssignPublicIp=ENABLED so the Fargate ENI gets a public IP.
  • Private subnet with a NAT gateway in the same VPC. Set AssignPublicIp=DISABLED.
• An enrollment token. (Manual mode also works, but Bootstrap fits Fargate’s container model better.)

You do not need to pre-create any IAM roles, log groups, secrets, or security groups. CloudFormation creates them all.

Walkthrough

Two ways to launch the same stack: the drawer’s one-click URL (easier) or the AWS CLI (scriptable). They produce identical infrastructure.

Option A - via the dashboard drawer

1. In the Argus dashboard, click Deploy agent.
2. Pick the Cloud (managed) shape.
3. Pick the Fargate tab (selected by default, marked “Recommended”).
4. Copy the enrollment token shown in the credential card.
5. Click Launch CloudFormation Stack. AWS opens the CloudFormation Quick-Create form in a new tab with the template URL and stack name pre-filled. The token is not in the URL by design (keeps the secret out of browser history).
6. In the AWS form, fill in:
   • EnrollmentToken: paste the token from step 4.
   • VpcId: pick your VPC.
   • SubnetId: pick a subnet in that VPC.
   • AssignPublicIp: ENABLED for a public subnet, DISABLED for a private subnet with NAT.
   • Leave other parameters at their defaults unless you have a reason to change them.
7. Acknowledge IAM creation (CloudFormation creates two IAM roles) and click Create stack.
8. The stack reaches CREATE_COMPLETE in about 60-90 seconds. Switch back to the Argus drawer to watch the Deployment progress strip flip green as the agent boots and connects.

Option B - via the AWS CLI

aws cloudformation create-stack \
  --region us-east-2 \
  --stack-name argus-agent-fargate \
  --template-url https://api.argusdspm.com/downloads/argus-managed-fargate-v1.yml \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameters \
    ParameterKey=EnrollmentToken,ParameterValue='argus_et_<your-token-here>' \
    ParameterKey=VpcId,ParameterValue=vpc-xxxxxxxxxxxxxxxxx \
    ParameterKey=SubnetId,ParameterValue=subnet-xxxxxxxxxxxxxxxxx \
    ParameterKey=AssignPublicIp,ParameterValue=ENABLED

Substitute --region, vpc-..., and subnet-... with your values. --template-url points at the Argus-hosted template; you can also download it and pass --template-body file://....

Parameters reference

Parameter	Default	Notes
EnrollmentToken	(required)	Bootstrap token. Stored as an AWS Secrets Manager SecureString.
VpcId	(required)	VPC where the agent runs.
SubnetId	(required)	Subnet in that VPC. Must reach the internet (public IP or NAT).
AssignPublicIp	ENABLED	ENABLED for public-subnet deploys, DISABLED for private subnets with NAT.
ArgusBackendUrl	https://api.argusdspm.com	Override only for self-hosted Argus.
AgentImage	ghcr.io/argusdspm/argus-agent:stable	Override to pin a version like :v0.7.9.
TaskCpu	512	Fargate vCPU units. 512 = 0.5 vCPU. Bump for larger scans.
TaskMemory	1024	Fargate memory MiB.

What gets deployed

CloudFormation creates these resources, all named after the stack name:

• ECS cluster (argus-agent-<stack-name>)
• ECS task definition (Fargate launch type, awsvpc network mode)
• ECS service (desired_count=1)
• IAM execution role (with the execution-role policy)
• IAM task role (with the discovery policy)
• Security group (egress 443 + DNS only, no inbound)
• AWS Secrets Manager secret (SecureString holding the enrollment token)
• CloudWatch log group (/ecs/argus-agent/<stack-name>, 14-day retention)

Verify

In the dashboard, the drawer’s Deployment progress strip turns all three signals green within a couple of minutes (cloud account connected, stack launched, agent registered). To verify from AWS:

aws ecs describe-services \
  --cluster argus-agent-<stack-name> \
  --services argus-agent-<stack-name> \
  --query 'services[0].[status,runningCount]' --output text
# expect: ACTIVE 1

aws logs tail /ecs/argus-agent/<stack-name> --follow
# expect lines including:
#   secure_credential_manager - No role ARN provided, using instance credentials
#   Bootstrapping via enrollment token (pool=baseline)...
#   Bootstrap succeeded - API key persisted for restart-safe auth.
#   Authenticated as '<your-agent-name>' (agent_xxx)
#   Polling for jobs (capacity=4)...

See Verifying connection for the full three-signal check.

Teardown

aws cloudformation delete-stack --stack-name argus-agent-fargate

Deletion takes a couple of minutes. The Secrets Manager secret is fully purged (no recovery window), so the same stack name can be reused immediately.