Skip to content
Argus DSPM

Deploy the agent - overview

The Argus agent is a single container image that runs inside your environment and does three things:

  1. Discovers datastores (S3, RDS, DynamoDB, Redshift, and more) inside the AWS account(s) it has read access to.
  2. Samples data from those datastores and runs sensitive-data detection locally, so the actual content never leaves your environment.
  3. Reports findings (counts, classifications, risk signals) back to the Argus control plane over outbound HTTPS only.

You deploy the agent once per cloud account you want Argus to scan. There are three deployment shapes, and within each shape there are sub-paths. Pick the combination that fits your environment.

The three shapes

Section titled “The three shapes”
Shape Best for What runs where
Cloud (managed) Single AWS account, one-click setup Agent on Fargate or EC2; IAM roles, security group, secret, and logs all provisioned by CloudFormation
Cloud (DIY) You manage your own IaC Agent on Fargate (Terraform) or ECS (task JSON), wired into your stack
Local / single-host Laptop, on-prem VM, edge, air-gapped Docker Compose, docker run, or an offline tarball; the agent assumes a role into the target account

Decision tree

Section titled “Decision tree”
Where do you want the agent to run?


|-- Inside the AWS account being scanned, and you want AWS to provision
|   everything in one click via CloudFormation:
|     |-- Production, scales with workload: Cloud (managed) -> Fargate
|     |-- Single host, simpler / cheaper:   Cloud (managed) -> EC2
|
|-- Inside the AWS account being scanned, but you manage the IaC yourself:
|     |-- Terraform in your stack:               Cloud (DIY) -> Terraform
|     |-- You already have an ECS cluster:       Cloud (DIY) -> ECS task JSON
|     |-- You just need the IAM policy text:     Cloud (DIY) -> IAM policy
|
|-- Outside AWS (laptop, on-prem VM, edge box) and reach AWS via a role:
      |-- Compose-managed setup:                 Local -> Docker Compose
      |-- Single ad-hoc container:               Local -> docker run
      |-- No internet on the target host:        Local -> Offline tarball

Pick your path

Section titled “Pick your path”

Before you start

Section titled “Before you start”

Every path shares the same setup: an Argus account, a registered cloud account, a credential, and (for cloud paths) IAM roles. Read Pre-flight first, then pick your path above.

The public IaC repo is the source of truth for the Cloud (managed) templates and the Cloud (DIY) Terraform module. The agent image is ghcr.io/argusdspm/argus-agent:stable (pin to a version like :v0.7.9 for production).