Skip to main content
With KMS key access, you choose whether Plerion can read the AWS resources you encrypt with your own customer managed AWS Key Management Service (KMS) keys. Plerion can decrypt with a key only if you allow it. Without that, the parts of a resource that the key protects stay hidden from Plerion. That is your choice to keep. The trade-off is that Plerion shows those resources only in part, and skips the checks and scans that need the hidden parts. If you want Plerion to show and check those resources in full, allow it for the keys you choose:
  • To show encrypted resource details, such as an Amazon Bedrock guardrail’s filters, let the Plerion access role decrypt with the key. See Read encrypted resource details.
  • To scan encrypted workloads, such as volumes and images, give the Plerion appliance role access to the key. See Workload scanning.

​
Read encrypted resource details

Some AWS services encrypt parts of a resource’s settings with the resource’s KMS key, and return those parts only to callers that can decrypt with the key. Amazon Bedrock and Amazon Bedrock AgentCore do this, for example for an AgentCore policy’s Cedar statement, a memory’s custom prompts, a guardrail’s filters, or an agent’s instructions. Amazon SageMaker does it for model cards and model packages. When the key is a customer managed key, AWS refuses to show these parts to the Plerion access role. Plerion still lists the resource, but its asset page says that Plerion can’t read part of it, and the checks that need those parts are skipped. To see those parts in Plerion, let the Plerion access role decrypt with the key. Otherwise nothing changes, and Plerion keeps showing the resource in part.

​
Let the Plerion access role decrypt with a key

First, copy the ARN of the Plerion access role. In the IAM console, open Roles, find the role whose name ends in PlerionAccessRole, and copy its ARN. For a key that encrypts Bedrock or AgentCore resources, add these two statements to the Statement list of the key’s policy. Replace <plerion-access-role-arn> with the ARN you copied, <account-id> with your AWS account ID, and <region> with the key’s region.
For a key that encrypts SageMaker model cards or model packages, add this statement:
  1. In the AWS KMS console, open Customer managed keys and choose the key.
  2. On the Key policy tab, choose Switch to policy view if the console shows the default view, then choose Edit.
  3. Add the statements to the Statement list, and choose Save changes.
Plerion reads the data on the integration’s next scan. The statements let only your Plerion access role decrypt with this key, and only when Amazon Bedrock, Amazon Bedrock AgentCore or Amazon SageMaker asks KMS on its behalf. The role cannot call KMS directly to decrypt with the key, and other AWS services, such as Amazon S3, cannot decrypt with it on the role’s behalf. Bedrock and AgentCore reach KMS in two ways, so both statements are needed: for example, AgentCore memories need the first and AgentCore policies need the second. This lets the Plerion access role read the decrypted Bedrock, AgentCore and SageMaker settings that the key protects. That is a narrow exception to the read-only posture access described in the security review.

​
Workload scanning

With this guide, you can grant Plerion appliances access to your customer managed AWS KMS (Key Management Service) keys. This access allows the Cloud Workload Protection Platform (CWPP) appliance to scan encrypted resources. For steps to enable or update the CWPP integration, see:
  1. Onboarding CWPP integration
  2. Updating AWS integration

​
Access modes

You can grant access in two modes, either during onboarding or when updating the AWS integration:
  1. All KMS keys
  2. Selected KMS keys
KMS access mode configuration showing all keys and selected keys options

​
All KMS keys mode

In this mode, the Plerion appliance is granted access to all KMS keys in the account. You can restrict specific keys by tagging them with PlerionAccess: Denied. This is recommended if your account has a large number of KMS keys. Example IAM policy statement added to the PlerionApplianceRole: