Cloud Accounts
A cloud account is the unit Argus organises everything else around: datastores, identities, jobs, and schedules all belong to one. Adding the account record here is only half of connecting it. The other half is deploying an agent into that account, which is covered in Deploy the agent.
Adding an account
Section titled “Adding an account”Add Account asks for very little, because Argus does not want your credentials:
- Account name - how it appears throughout the product, for example
Production. - Cloud provider - the selector only appears when more than one provider is enabled for your deployment.
- AWS Account ID - the 12-digit account number. It is validated in the form, so a typo surfaces immediately rather than as a failed job later.
- Region - the default region for this account.
That is the whole AWS form. There is no role ARN and no access key, because the agent supplies its own AWS credentials at runtime from its instance profile or task role, inside your VPC. Argus never holds an IAM principal of yours. Azure is different: it uses a service principal with the Argus scanner role assigned at the subscription, and the form collects those fields from the provider registry.
After saving, deploy an agent into the account. Until one reports in, the account exists but nothing can run against it.
Reading the table
Section titled “Reading the table”The summary row counts Total Accounts, Connected, and Disconnected. Underneath, each row carries name (with the last connection error inline, if there was one), provider, account ID, region, status, last connected, and the schedule.
Two status chips, two different failures
Section titled “Two status chips, two different failures”The Status column shows two badges, and conflating them sends you down the wrong debugging path:
| Chip | Question it answers | When it is bad |
|---|---|---|
| Connected / Disconnected | Has Argus proven it has cloud access to this account? | Disconnected means the IAM role or permissions are wrong. Fix the access. |
| Agent online / No agent | Is at least one agent in this tenant currently alive? | No agent means discoveries and scans cannot run at all, no matter how good the access is. Fix the agent. |
An account can be Connected with No agent (access is fine, nothing is running) or Disconnected with an agent online (something is alive, but it cannot reach this account). Treat them separately.
The Schedule column
Section titled “The Schedule column”Shows the effective scan cadence and when the next run is due, for example
Every 24h - next in 7h. If scanning has never run for the account it reads
pending first run, and if you have turned automatic scanning off it reads Auto-scan off.
Row actions
Section titled “Row actions”The play button on each row runs a full assessment (below). The kebab menu holds the rest:
| Action | What it does |
|---|---|
| View enrollment token | Shows the token prefix, the linked agent, creation and last-rotation timestamps, and the rate limit, and lets you rotate. A newly issued token is displayed once and never again. |
| Edit schedule | Opens the schedule dialog (below). |
| Edit account | Changes the display name and default region. |
| Run discovery now | Dispatches datastore discovery and IAM discovery together, as two independent jobs, then offers links to the Datastores and Identity pages where results land. |
| View jobs for this account | Opens the Agents page job list filtered to this account. |
| Test agent reachability | Verifies the connection and permissions now, and updates the Connected chip with the result. |
| Disconnect account | Stops cloud access until reconnected. The configuration is preserved; nothing is deleted. |
| Reconnect account | Re-attempts the connection. Replaces Disconnect on a disconnected account. |
| Delete account | Permanently deletes the account and its associated data. Not reversible. |
Which of these you see depends on your permissions: the whole management set requires write access to cloud accounts, and deletion is a separate permission again.
Schedules
Section titled “Schedules”Edit schedule controls two independent cadences per account. Each can inherit the tenant-wide default (shown in the dropdown, so you always know what you would fall back to) or be pinned to a fixed interval, and each has its own on/off switch.
| Setting | Intervals | Governs |
|---|---|---|
| Data Scan | 6, 12, 24, 48, or 72 hours | Re-scanning datastore contents: classification, findings, risk. |
| Discovery | 6, 12, 24, or 48 hours | The discovery pass, which dispatches datastore discovery and IAM discovery together. |
Each section shows when its next run is due, or Auto-scheduling disabled if you have turned
it off.
Two behaviours worth knowing:
- Scheduled runs only fire on connected accounts. A disconnected account is skipped entirely, and its schedule does not queue work in the background waiting for a fix.
- A busy account is skipped, not queued twice. If scans or discoveries from the previous cycle are still running when the next one comes due, Argus advances the schedule instead of stacking duplicate jobs on top of a queue that is already draining.
Scheduled scans skip hidden and not-found datastores, and they run at the tenant’s configured scan intensity. The trade-offs of that intensity setting are covered in Sampling & extrapolation; the not-found lifecycle is in Discovery & scanning.
Running an assessment on demand
Section titled “Running an assessment on demand”The play button opens Run account assessment, the one-shot version of everything the schedule does automatically:
- What to run. Discovery + scan finds every datastore and then scans each for sensitive data and risk. Discovery only just inventories the account, leaving scanning for later from the Datastores page. Use discovery-only on a first connection to a large account, when you want to see the shape of the estate before committing to scan time.
- Scan intensity. Low is a quick surface pass with minimal sampling, Medium is the balanced default with smart sampling, and High is a comprehensive deep scan at the highest accuracy and the highest cost in time. The control is seeded from your tenant default and only appears when you are actually scanning.
- Include identity analysis (AWS). Discovers IAM users, roles, and access in parallel with the datastore work.
While it runs, progress shows in the assessment ring in the top bar: percent complete, datastores discovered, job counts, and an estimate of the time remaining, with a cancel action. When it finishes you get a summary card with datastores found, total size, high-risk count, public count, and a link to the dashboard.
If some datastores need database credentials, the modal warns you up front that those will be skipped. Supply them from the datastore’s detail drawer and re-scan. See Datastores.
When something is not working
Section titled “When something is not working”- Disconnected, with an error under the account name. The message is the cloud provider’s own. Fix the permission and use Test agent reachability to confirm.
- No agent. Nothing will run. Start at Verifying connection, then Troubleshooting.
- Connected, agent online, but nothing appears. Use View jobs for this account to see whether jobs are being claimed and what they are failing on.