Cloud (managed): Fargate

A one-click CloudFormation deploy that runs the agent as an ECS Fargate service inside the AWS account being scanned. AWS provisions everything: ECS cluster, IAM roles, security group, Secrets Manager secret, log group, task definition, and a Fargate service with desired_count=1.

What this stack does and does not do

It opens no inbound ports, and it creates no role Argus can assume: every trust policy names an AWS service inside your own account, never an Argus principal. Your credentials never leave your account. The full resource-by-resource list is in What gets created in your account.

When to pick this

• You want production-shaped infra (managed compute, no host to patch).
• You want the option to scale out later (the Fargate service is the natural starting point for burst-autoscale).
• You do not need shell access to the agent runtime (aws ecs execute-command is available if you ever do).

Prerequisites

• Complete Pre-flight first.
• A VPC (the default VPC in any region works for first-deploy validation).
• A subnet with a path to the internet, one of:
  • Public subnet with MapPublicIpOnLaunch=true. Set AssignPublicIp=ENABLED so the Fargate ENI gets a public IP.
  • Private subnet with a NAT gateway in the same VPC. Set AssignPublicIp=DISABLED.
• An enrollment token. (Manual mode also works, but Bootstrap fits Fargate’s container model better.)

You do not need to pre-create any IAM roles, log groups, secrets, or security groups. CloudFormation creates them all.

Walkthrough

Two ways to launch the same stack: the drawer’s one-click URL (easier) or the AWS CLI (scriptable). They produce identical infrastructure.

Option A - via the dashboard drawer

1. In the Argus dashboard, click Deploy agent.
2. Pick the Cloud (managed) shape.
3. Pick the Fargate tab (selected by default, marked “Recommended”).
4. Copy the enrollment token shown in the credential card.
5. Click Launch CloudFormation Stack. AWS opens the CloudFormation Quick-Create form in a new tab with the template URL and stack name pre-filled. The token is not in the URL by design (keeps the secret out of browser history).
6. In the AWS form, fill in:
   • EnrollmentToken: paste the token from step 4.
   • VpcId: pick your VPC.
   • SubnetId: pick a subnet in that VPC.
   • AssignPublicIp: ENABLED for a public subnet, DISABLED for a private subnet with NAT.
   • Leave other parameters at their defaults unless you have a reason to change them.
7. Acknowledge IAM creation (CloudFormation creates two IAM roles) and click Create stack.
8. The stack reaches CREATE_COMPLETE in about 60-90 seconds. Switch back to the Argus drawer to watch the Deployment progress strip flip green as the agent boots and connects.

Option B - via the AWS CLI

aws cloudformation create-stack \
  --region us-east-2 \
  --stack-name argus-agent-fargate \
  --template-url https://api.argusdspm.com/downloads/argus-managed-fargate-v1.yml \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameters \
    ParameterKey=EnrollmentToken,ParameterValue='argus_et_<your-token-here>' \
    ParameterKey=VpcId,ParameterValue=vpc-xxxxxxxxxxxxxxxxx \
    ParameterKey=SubnetId,ParameterValue=subnet-xxxxxxxxxxxxxxxxx \
    ParameterKey=AssignPublicIp,ParameterValue=ENABLED

Substitute --region, vpc-..., and subnet-... with your values. --template-url points at the Argus-hosted template; you can also download it and pass --template-body file://....

Parameters reference

Parameter	Default	Notes
EnrollmentToken	(required)	Bootstrap token. Stored as an AWS Secrets Manager SecureString.
VpcId	(required)	VPC where the agent runs.
SubnetId	(required)	Subnet in that VPC. Must reach the internet (public IP or NAT).
AssignPublicIp	ENABLED	ENABLED for public-subnet deploys, DISABLED for private subnets with NAT.
ArgusBackendUrl	https://api.argusdspm.com	Override only for self-hosted Argus.
AgentImage	ghcr.io/argusdspm/argus-agent:stable	Override to pin a specific release tag.
EnableRemediation	false	Grant Argus write access so it can FIX what it finds. Off by default: the default deployment can inspect the account but cannot change anything in it. Turn on at launch or later by updating the stack; the agent is not replaced and needs no re-enrolling. See IAM permissions.
TaskCpu	512	Fargate vCPU units. 512 = 0.5 vCPU. Bump for larger scans.
TaskMemory	1024	Fargate memory MiB.
EnableBurstAutoscaling	false	Run an autoscaled burst pool alongside the baseline. Turn on at launch, or later by updating the stack (no redeploy or token change needed).
BurstMaxCapacity	5	Max burst tasks (used only when autoscaling is on). Burst scales 0..this; baseline is always 1.
BurstScaleOutBacklog	20	Add a burst task when the unclaimed backlog stays at or above this for one minute. The editable scale-out trigger.
BurstScaleInBacklog	5	Remove a burst task when the backlog stays below this for three minutes. Keep below BurstScaleOutBacklog to avoid flapping.

Burst autoscaling

Set EnableBurstAutoscaling=true (at launch or via a later stack update) to add an autoscaled burst pool next to the always-on baseline. It adds burst tasks as the unclaimed scan backlog grows past BurstScaleOutBacklog and drops them back to zero when the backlog drains below BurstScaleInBacklog. The baseline stays at 1 and emits the backlog metric the autoscaler reads, so scaling works even when burst is at zero. No token change is needed: the enrollment token already permits both pools. Enabling it later is a stack update on the same stack, not a new deploy.

What gets deployed

CloudFormation creates these resources, all named after the stack name:

• ECS cluster (argus-agent-<stack-name>)
• ECS task definition (Fargate launch type, awsvpc network mode)
• ECS service (desired_count=1)
• IAM execution role (with the execution-role policy)
• IAM task role (with the discovery policy)
• Security group (egress 443 + DNS only, no inbound)
• AWS Secrets Manager secret (SecureString holding the enrollment token)
• CloudWatch log group (/ecs/argus-agent/<stack-name>, 14-day retention)
• On the default rolling :stable image only: an EventBridge Scheduler schedule (argus-agent-<stack-name>-weekly-refresh) plus its IAM role (ArgusAgentScheduler-<stack-name>), which force a new service deployment once a week so the agent keeps tracking :stable. A running Fargate task never re-pulls its image, so this is what makes stable actually stay current. Pinned deploys skip both resources and never auto-update.
• When EnableBurstAutoscaling=true: a burst task definition + service (scale-to-zero), an Application Auto Scaling target, two step-scaling policies, and two CloudWatch alarms on the ArgusDSPM/Agent PendingJobs backlog metric.

Verify

In the dashboard, the drawer’s Deployment progress strip turns all three signals green within a couple of minutes (cloud account connected, stack launched, agent registered). To verify from AWS:

aws ecs describe-services \
  --cluster argus-agent-<stack-name> \
  --services argus-agent-<stack-name> \
  --query 'services[0].[status,runningCount]' --output text
# expect: ACTIVE 1

aws logs tail /ecs/argus-agent/<stack-name> --follow
# expect lines including:
#   secure_credential_manager - No role ARN provided, using instance credentials
#   Bootstrapping via enrollment token (pool=baseline)...
#   Bootstrap succeeded - API key persisted for restart-safe auth.
#   Authenticated as '<your-agent-name>' (agent_xxx)
#   Polling for jobs (capacity=4)...

See Verifying connection for the full three-signal check.

Teardown

aws cloudformation delete-stack --stack-name argus-agent-fargate

Deletion takes a couple of minutes. The Secrets Manager secret is fully purged (no recovery window), so the same stack name can be reused immediately.