Customer-facing infrastructure-as-code for deploying the Argus DSPM agent into your own cloud account. Your sensitive data never leaves your environment - only metadata and findings summaries are sent to the Argus control plane.

This repo contains:

• Terraform modules for AWS EC2, AWS Fargate, and (preview) Azure ACI.
• CloudFormation template for one-click AWS EC2 deploy via CFN Quick-Launch.
• Examples showing minimal usage for each module.

You will also need an enrollment token from the Argus dashboard (Settings → Cloud Accounts → Generate Enrollment Token). Keep it secret - it is reusable and bootstraps any number of agents into the cloud account it was issued for.

All modules pull the agent image from the public registry ghcr.io/argusdspm/argus-agent:stable. No AWS ECR authentication required.

The module assumes you already have an aws provider configured. In a fresh project, drop the following in a providers.tf next to your main.tf:

terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

provider "aws" {
  region = "us-east-2" # match the region you want the agent to run in
}

Then main.tf:

module "argus" {
  source            = "github.com/argusdspm/deploy-argus//modules/argus-agent-fargate?ref=v0.9.0"
  customer_name     = "production"
  enrollment_token  = var.enrollment_token
  argus_backend_url = "https://api.argusdspm.com"
  vpc_id            = "vpc-xxxxxxxx"
  subnet_ids        = ["subnet-aaaa", "subnet-bbbb"]

  # Set true when your subnets are public (default-VPC style) and have no NAT
  # gateway. Leave false (the default) when running in private subnets that
  # reach the internet via NAT.
  assign_public_ip = false

  enable_s3_scanning = true
}

variable "enrollment_token" {
  type      = string
  sensitive = true
}

terraform init
terraform apply -var enrollment_token="<your-enrollment-token>"

The module reads the AWS region from the configured provider via data.aws_region.current. Set aws_region explicitly only if you want a different region than the provider.

For the EC2 module, replace argus-agent-fargate with argus-agent-ec2 and follow examples/ec2-basic.

For teams that manage ECS tasks directly (console, CDK, custom CLI) without Terraform. You bring an ECS cluster, two IAM roles, a security group, and an AWS Secrets Manager secret holding the enrollment token; the snippet is just the task definition itself.

1. Store the enrollment token in Secrets Manager:

aws secretsmanager create-secret \
  --name argus-agent/enrollment-token \
  --secret-string "<paste-token-here>"

Note the returned ARN - the task definition references it.

2. Create two IAM roles:

• An execution role (used by ECS to read the secret + ship logs).
• A task role (the agent process identity for datastore scan).

Trust policy for both: ecs-tasks.amazonaws.com. Permissions are in the IAM policy section below.

3. Task definition (replace the four <...> placeholders):

{
  "family": "argus-agent",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512", "memory": "1024",
  "executionRoleArn": "<EXEC_ROLE_ARN>",
  "taskRoleArn": "<TASK_ROLE_ARN>",
  "containerDefinitions": [{
    "name": "argus-agent",
    "image": "ghcr.io/argusdspm/argus-agent:stable",
    "essential": true,
    "environment": [
      {"name": "ARGUS_BACKEND_URL", "value": "https://api.argusdspm.com"},
      {"name": "CLOUD_PROVIDER", "value": "aws"},
      {"name": "ENROLLMENT_POOL", "value": "baseline"}
    ],
    "secrets": [
      {"name": "ENROLLMENT_TOKEN", "valueFrom": "<TOKEN_SECRET_ARN>"}
    ],
    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group": "/ecs/argus-agent",
        "awslogs-region": "<REGION>",
        "awslogs-stream-prefix": "agent",
        "awslogs-create-group": "true"
      }
    }
  }]
}

4. Register + run:

aws ecs register-task-definition --cli-input-json file://task.json
aws ecs run-task \
  --cluster <YOUR_CLUSTER> \
  --task-definition argus-agent \
  --launch-type FARGATE \
  --network-configuration "awsvpcConfiguration={subnets=[<SUBNET>],securityGroups=[<SG>],assignPublicIp=ENABLED}"

Note: the awslogs-group value, the secret ARN in secrets[], and the log-group ARN pattern in the execution role's IAM policy must all agree on the same names. The task definition uses awslogs-create-group: true so the log group does not need to exist before first run, but the execution role must allow logs:CreateLogGroup on the matching ARN pattern.

The DIY paths above need two separate IAM policies on two separate roles. Mixing them onto one role works but breaks least-privilege.

The policies are not reproduced here. They were, and the copy drifted: it granted s3:GetBucketEncryption (not a real IAM action - the API is authorized by s3:GetEncryptionConfiguration, so that spelling granted nothing) and was missing every iam:, redshift: and kms: action, which meant identity discovery could not run at all for anyone who copied it.

The permission set has a single source of truth in the product (argus_agent/core/verification_permissions.py), and every published artifact is generated from it and held in lock-step by a contract test. Copy the current policies from:

• IAM permissions - the task-role (discovery) policy, the execution-role policy, and every trust policy, kept current automatically.

The Terraform modules in this repository already apply the correct policies for you; the link above is only needed for the ECS task JSON and Local paths, where you create the roles by hand.

For least-privilege at scale, narrow the Resource on per-service Sids (e.g. restrict S3 actions to specific bucket ARNs). The wildcard is the recommended starting point for first-deploy validation.

The managed CloudFormation templates are served by the Argus control plane, which is what the in-app Deploy Agent drawer links to. Use the drawer: it builds the Quick-Launch URL with your stack name, region and selected agent version already filled in.

Templates are also fetchable directly if you want to review one before deploying, or upload it to the CloudFormation console yourself:

https://api.argusdspm.com/downloads/argus-managed-ec2-v1.yml
https://api.argusdspm.com/downloads/argus-managed-fargate-v1.yml

Paste your enrollment token into the EnrollmentToken field manually - it is deliberately not included in any Quick-Launch URL, to keep the secret out of browser history and referer headers.

This repository no longer ships its own copy of the CloudFormation template. It had diverged from the served one (it read the enrollment token from SSM Parameter Store rather than Secrets Manager, and never received the opt-in SSH parameters), and two copies of one template will always re-diverge. This repo is the home of the Terraform modules; CloudFormation is served by the product.

• EC2 / Fargate: agent container running with a least-privilege task role (S3 read, RDS describe, etc. - only the datastore types you opt in to). The enrollment token sits encrypted in SSM Parameter Store; the agent reads it once at boot and exchanges it for a per-container API key via /api/v1/agents/bootstrap.
• Networking: outbound HTTPS to api.argusdspm.com only. No inbound ports.
• Secrets: only the enrollment token is provisioned by Terraform. The post-exchange per-container API key lives inside the running container and is not persisted by the IaC.

The agent never accepts inbound connections from the Argus control plane. All data flow is agent-initiated outbound.

Detailed logs live at /aws/ec2/argus-agent/* (CloudWatch) for EC2 and /ecs/argus-agent-baseline / /ecs/argus-agent-burst for Fargate.

Every release is tagged with full semver (vX.Y.Z). Pin the tag in your source = "...?ref=vX.Y.Z" to avoid breaking changes mid-flight. Pre-v1.0 the tag tracks the agent version; v1.0.0 ships when agent + backend co-release stable. Full policy in CHANGELOG.md.

See CHANGELOG.md for what changed in each release and COMPATIBILITY.md for the deploy-argus ↔ argus version matrix.

• Issues: https://github.com/argusdspm/deploy-argus/issues
• Docs: https://docs.argusdspm.com
• Status: https://status.argusdspm.com

MIT - see LICENSE.