> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-on-aws-ecs-ec2-clusters.md).
# Install the Cortex XDR agent on AWS ECS EC2 Clusters
An Amazon ECS cluster utilizing the EC2 launch type consists of user-managed virtual servers (EC2 instances) configured to run containerized applications.
To deploy the agent, you create a Cortex XDR agent installation package for Linux on AWS ECS EC2 Clusters, which is deployed as a JSON task definition file. Once the agent is running on the endpoint, the agent offers the same protection capabilities and operates as any standard Cortex XDR agent for Linux.
Cortex issues a license for every node on which the agent is running, and will revoke the license once the agent is removed or the node is deleted. The Cortex management console displays the AWS ECS EC2 Cluster and includes a visual indication on processes that are running within containers, including information about the container itself such as its name, ID, image, etc.
**Prerequisites**
| Requirement | Description |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **System Architecture** | - Supports X86\_64 and ARM64 architectures; hybrid clusters and Windows are unsupported.
- Cortex XDR agent 9.1 or later
|
| **AWS IAM Roles** | The following roles and policies are required for proper communication and logging:
- ecsTaskExecutionRole: Required to pull images and send logs to CloudWatch.
- AmazonECSTaskExecutionRolePolicy: This role grants the ECS agent permission to perform actions on behalf of your task. This is important for things like pulling container images from Amazon ECR and sending logs to Amazon CloudWatch.
- CloudWatchLogsFullAccess: Recommended to view container standard output.
- ecsInstanceRole: Grants the ECS agent on the EC2 instance permission to communicate with the ECS service.
- AWSServiceRoleForECS: Allows ECS to manage resources such as load balancers and container instances.
|
Create the Cortex XDR agent AWS ECS EC2 installer
1. In your Cortex management console, navigate to **Inventory** → **Endpoints** → **Installations**.
2. Click Create and select Amazon ECS EC2 Installer as the Package Type.
3. Configure the mandatory parameters, including Name, Version (9.1 or later), Family (the AWS Task Definition name), and the Cluster name.
4. Once created, download the installer, which is provided as a valid JSON task definition file.
Deploying the Agent Task Definition and Service
1. Navigate to Task Definitions in the AWS ECS console and select Create new task definition with JSON.
2. Paste the JSON content from the Cortex XDR installer into the configuration area and save the new revision.
3. Go to your ECS Cluster, select the **Services** tab, and click Create.
4. In the Deployment Configuration, set the Launch type to EC2.
5. Important - Select Daemon as the Service type. This ensures that one copy of the Cortex XDR agent task runs on every container instance (EC2 VM) within the cluster.
6. Complete the creation process; AWS will run a CloudFormation Stack in the background to deploy the service.
Once the service is stable, verify the deployment:
* In the Cortex management console, check the All Endpoints table. The endpoint type should appear as Amazon ECS EC2.
* The Protection Status column should show Protected.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-on-aws-ecs-ec2-clusters.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.