> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/33/install/deploy-console/console-on-fargate.md).

# Console on Fargate

You can run Prisma Cloud Console in AWS Fargate.

This procedure assumes you’ve already created an ECS cluster.

## Create a security group

Create a security group that opens ports 8083-8084 for Prisma Cloud Console and port 2049 for NFS.

1. In the AWS console, go to **Services > Compute > EC2 > Security Groups**.
2. Click **Create security group**.
3. In **Security group name**, enter a name, such as **pc-security-group**.
4. In **Description**, enter **Prisma Cloud Compute Console on Fargate**.
5. In **VPC**, select the VPC where your ECS cluster runs.
6. Create an inbound rule for Prisma Cloud Console ports.
   1. Under **Inbound rules** , click **Add rule**.
   2. Under **Type**, select **Custom TCP**.
   3. Under **Port range**, enter **8083-8084**.
   4. Under **Source**, select **Anywhere**.
7. Create an inbound rule for NFS, where Console stores its data.
   1. Click **Add rule**.
   2. Under **Type**, select **NFS**.
   3. Under **Source**, select **Anywhere**.
8. Click **Create security group**.
9. Write down the security group ID and save it for later.

## Create an EFS file system

Create a highly available file system for Console to store its data.

1. In the AWS console, go to **Services > Storage > EFS**.
2. Click **Create file system**.
3. Click **Customize** to open a more detailed dialog.
4. Enter a value for **Name**, such as **pc-efs-console**.
5. Set the throughput mode to **Provisioned**.
6. Set **Provisioned Throughput (MiB/s)** to 0.1 MiB/s per Defender that will be deployed.
7. Click **Next**.
8. In **VPC**, select the VPC where your EC2 cluster runs and the relevant mount targets.
9. For each mount target, change the security group to the ID of the pc-security-group.
10. Click **Next**, accepting all defaults, until the file system is created.
11. Write down the file system ID and save it for later.

## Create target groups

Create two target groups for the load balancer, one for port 8083 and one for port 8084.

1. In the AWS console, go to **Services > Compute > EC2 > Load Balancing > Target Groups**.
2. Click **Create target group**.
3. In **Basic configuration**, select **IP addresses**.
4. Enter a value for **Name**, such as **pc-tgt-8083** or **pc-tgt-8084**.
5. Set **Protocol** to **TCP** and **Port** to **8083** or **8084** respectively.
6. In VPC, select the VPC where your ECS cluster runs.
7. For port 8083 only, specify the following health check configuration:
   * **Health check protocol**: **HTTPS**
   * **Health check path**: **/**
   * **Port**: **Traffic port**
   * Accept the default values for all other settings.
8. Click **Next**, and then click **Create target group**.
9. Repeat the process for port 8084, but accept the default values for the health check configuration.

   The health check protocol for 8084 must be **TCP**.
10. Write down the ARN for both target groups, and save them for later.

## Create a load balancer

Create a network load balancer to route traffic to the Console container.

1. In the AWS console, go to **Services > Compute > EC2 > Load Balancers**.
2. Click **Create Load Balancer**.
3. Choose **Network Load Balancer** and **Create**.
4. Enter a value for **Name**, such as **pc-ecs-lb**.
5. Under **Network mapping**, select the VPC and subnet where the Prisma Cloud Console task will run.
6. Under **Listeners and routing**, create a listener for port 8083.
   1. Set **Protocol** to **TCP**.
   2. Set **Port** to **8083**.
   3. Set **Default action** to **Forward to: pc-tgt-8083**.
7. Create a listener for port 8084.
   1. Click **Add listener**.
   2. Set **Protocol** to **TCP**.
   3. Set **Port** to **8084**.
   4. Set **Default action** to **Forward to: pc-tgt-8084**.
8. Click **Create load balancer**.
9. Write down the DNS name for the load balancer, and save it for later.

## Create task definition

Use twistcli to generate a task definition for Console.

Each task definition’s Console can support up to 1000 deployed Defenders.

The following table lists valid values for cpu-limit and memory-limit:

| CPU limit     | Memory limit (MiB)                                                                        |
| ------------- | ----------------------------------------------------------------------------------------- |
| 1024 (1 vCPU) | 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) |
| 2048 (2 vCPU) | Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB)                        |
| 4096 (4 vCPU) | Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB)                        |

1. Download the Prisma Cloud Compute Edition release tarball, and unpack it.
2. Run twistcli to create the task definition.

   ```
   ./<PLATFORM>/twistcli console export fargate \
   --registry-token <registry token>  \
   --cluster-ip <load balancer dns name> \
   --memory-limit <memory limit number> \
   --cpu-limit <cpu limit number> \
   --efs-volume <efs ID>
   ```

   For example:

   ```
   ./linux/twistcli console export fargate \
   --registry-token <my_registry_token_id_string>  \
   --cluster-ip my-fargate-console-dns-address.elb.us-east-1.amazonaws.com \
   --memory-limit 8192 \
   --cpu-limit 2048 \
   --efs-volume fs-12345678
   ```
3. In the AWS console, go to **Services > Containers > Elastic Container Service > Task Definitions**.
4. Click **Create new Task Definition**.
5. Click **Fargate**, then **Next step**.
6. Scroll to the bottom of the page, and click **Configure via JSON**.
7. Clear the text box, paste the contents of **twistlock-console.json** which was generated by twistcli, and click **Save**.
8. In **Task Role**, specify **ecsTaskExecutionRole**.
9. Click **Create**.
10. Click **View Task Definition**.
11. Copy the task definition name and revision (e.g., **pc-console:1**).

## Create Fargate service

Create the Fargate service.

1. In the AWS console, go to **Services > Networking & Content Delivery > VPC > Subnets**.
2. Filter the subnets by the VPC where your ECS cluster runs, and write down subnet IDs of the relevant availability zones.
3. Fill out the ECS service JSON with all values you’ve set aside until now.

   Replace the strings between the `< >` characters, and save the file with the name fargate-pc-console-service.json.

   ```json
   {
       "cluster": "<cluster name>",
       "serviceName": "pc-console",
       "taskDefinition": "<task definition name>:<revision>",
       "loadBalancers": [
                   {
                       "targetGroupArn": "<pc-tgt-8083 ARN>",
                       "containerName": "twistlock-console",
                       "containerPort": 8083
                   },
                                   {
                       "targetGroupArn": "<pc-tgt-8083 ARN>",
                       "containerName": "twistlock-console",
                       "containerPort": 8084
                   }
       ],
       "desiredCount": 1,
       "launchType": "FARGATE",
       "deploymentConfiguration": {
           "maximumPercent": 100,
           "minimumHealthyPercent": 0
       },
       "platformVersion": "1.4.0",
       "networkConfiguration": {
           "awsvpcConfiguration": {
               "subnets": [
                   "<subnet ID>",
                   "<subnet ID>"
               ],
               "securityGroups": [
                   "<security group ID>"
               ],
               "assignPublicIp": "ENABLED"
           }
       },
       "enableECSManagedTags": true
   }
   ```
4. Create the service using awscli.

   ```
   aws ecs create-service --cli-input-json file://path/to/fargate-pc-console-service.json
   ```

   If successful the service is successfully created, awscli outputs the full JSON for the service being deployed.
5. In the AWS console, go to **Services > Containers > Elastic Container Service > Clusters**, click your cluster.
6. In the **Services** tab, click the service name (**pc-console**).

   You should see the details for load balancing and network access.
7. In the **Tasks** tab, you should find details about the running container.

## Log into Prisma Cloud Console

Open a web browser and go to `https://<Load balancer DNS name>:8083`. Create an initial admin account, and then enter your license to activate Console.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/33/install/deploy-console/console-on-fargate.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.