Amazon EC2
Vendor key: aws_ec2. In Arthur this source appears as AWS EC2. For how source fields and scan configs fit together, see Agent Discovery Integrations.
Discovers agentic coding tools, local agents, AI browsers and browser extensions installed on your Linux EC2 instances. The Arthur discovery collector runs on each instance and writes its results to the instance's Systems Manager (SSM) custom inventory, and Arthur reads them through the SSM API. Nothing connects to the instance. One source reads one account, or many accounts in your organization, in the regions you name.
Before you start
- Make sure Systems Manager manages the instances you want to scan.
- Deploy the Arthur discovery collector with the Arthur CloudFormation template, as a stack in each region of one account or as a StackSet across your organization. The template can also create the inventory association that uploads the collector's results, and the role that Arthur assumes.
For step-by-step instructions, see the AWS EC2 setup guide.
Source fields
| Field | Required | Sensitive | Default | Description |
|---|---|---|---|---|
regions | Yes | No | Comma-separated AWS regions, for example us-east-1,eu-west-1, or all for every region each account has enabled. Named regions must be in one AWS partition. | |
accounts | No | No | The credential's own account | all for every active account in your organization, or comma-separated 12-digit account IDs. Arthur reads each account through its member role. |
include_tags | No | No | All instances | Comma-separated key=value instance tags. Only instances with at least one of these tags are scanned. |
exclude_tags | No | No | None | Comma-separated key=value instance tags. Instances with any of these tags are skipped. If an instance matches both lists, it's excluded. |
role_arn | No | No | An IAM role in the account to assume for the scan, for example arn:aws:iam::123456789012:role/arthur-discovery. Not needed with accounts. | |
external_id | No | No | The external ID the role's trust policy requires. Sent when assuming role_arn, or each account's member role when you set accounts. | |
member_role_name | No | No | arthur-ai-discovery | The name (not the ARN) of the role Arthur assumes in each account when you set accounts. The default is the name the Arthur CloudFormation template gives it. |
access_key_id | No | Yes | An IAM access key ID. Set it together with secret_access_key. | |
secret_access_key | No | Yes | The secret of the IAM access key. |
Leave access_key_id and secret_access_key empty only if your Arthur engine is configured to use its own AWS credentials (ARTHUR_ENGINE_AWS_EC2_ALLOW_DEFAULT_CREDENTIALS=true).
Tag matching is exact and case-sensitive. A tag no instance carries is reported with a count of 0. A tag that isn't written as key=value fails the scan.
Scan config
| Setting | Value |
|---|---|
query | "" to use Arthur's built-in agent catalog, or your own catalog YAML. |
query_language | none |
lookback_window_seconds | Arthur lists every instance on every scan. Instances whose collector hasn't reported within this window are counted and their results aren't published. 0 publishes every instance's most recent report. |
Arthur counts running instances that Systems Manager doesn't manage as not-ssm-managed, and Windows instances as unsupported-platform, so an instance the collector never reached is counted rather than missed.
Required permissions
ec2:DescribeInstancesssm:DescribeInstanceInformationssm:ListInventoryEntriesec2:DescribeRegions. Needed only ifregionsisall.
Grant these actions and nothing more. AWS managed policies such as ReadOnlyAccess include them, but they also read Parameter Store values and instance user data.
With accounts, the credential needs sts:AssumeRole on the member roles instead, plus organizations:ListAccounts when accounts is all, from the management account or a delegated administrator. The member role in each account holds the actions above, including ec2:DescribeRegions.
If an account's role can't be assumed, or a region isn't enabled or is refused, the scan reads the rest and reports it as a denied scope. If every account and region is refused, the scan fails.
Updated 1 day ago