Install the Cortex XDR agent on AWS ECS EC2 Clusters

Learn how to install the Cortex XDR agent on AWS ECS EC2 clusters

An Amazon ECS cluster utilizing the EC2 launch type consists of user-managed virtual servers (EC2 instances) configured to run containerized applications.

To deploy the agent, you create a Cortex XDR agent installation package for Linux on AWS ECS EC2 Clusters, which is deployed as a JSON task definition file. Once the agent is running on the endpoint, the agent offers the same protection capabilities and operates as any standard Cortex XDR agent for Linux.

Cortex issues a license for every node on which the agent is running, and will revoke the license once the agent is removed or the node is deleted. The Cortex management console displays the AWS ECS EC2 Cluster and includes a visual indication on processes that are running within containers, including information about the container itself such as its name, ID, image, etc.

Prerequisites

Requirement	Description
System Architecture	Supports X86_64 and ARM64 architectures; hybrid clusters and Windows are unsupported. Cortex XDR agent 9.1 or later
AWS IAM Roles	The following roles and policies are required for proper communication and logging: ecsTaskExecutionRole: Required to pull images and send logs to CloudWatch. AmazonECSTaskExecutionRolePolicy: This role grants the ECS agent permission to perform actions on behalf of your task. This is important for things like pulling container images from Amazon ECR and sending logs to Amazon CloudWatch. CloudWatchLogsFullAccess: Recommended to view container standard output. ecsInstanceRole: Grants the ECS agent on the EC2 instance permission to communicate with the ECS service. AWSServiceRoleForECS: Allows ECS to manage resources such as load balancers and container instances.

Create the Cortex XDR agent AWS ECS EC2 installer

1. In your Cortex management console, navigate to Inventory → Endpoints → Installations.
2. Click Create and select Amazon ECS EC2 Installer as the Package Type.
3. Configure the mandatory parameters, including Name, Version (9.1 or later), Family (the AWS Task Definition name), and the Cluster name.
4. Once created, download the installer, which is provided as a valid JSON task definition file.

Deploying the Agent Task Definition and Service

1. Navigate to Task Definitions in the AWS ECS console and select Create new task definition with JSON.
2. Paste the JSON content from the Cortex XDR installer into the configuration area and save the new revision.
3. Go to your ECS Cluster, select the Services tab, and click Create.
4. In the Deployment Configuration, set the Launch type to EC2.
5. Important - Select Daemon as the Service type. This ensures that one copy of the Cortex XDR agent task runs on every container instance (EC2 VM) within the cluster.
6. Complete the creation process; AWS will run a CloudFormation Stack in the background to deploy the service.

Once the service is stable, verify the deployment:

• In the Cortex management console, check the All Endpoints table. The endpoint type should appear as Amazon ECS EC2.
• The Protection Status column should show Protected.