> ## Documentation Index > Fetch the complete documentation index at: https://docs.plerion.com/llms.txt > Use this file to discover all available pages before exploring further. # See resources encrypted with your KMS keys > Plerion can't read data you encrypt with your own KMS keys unless you allow it. Allow it for the keys you choose, so Plerion can show and check those resources in full. With **[KMS key access](#read-encrypted-resource-details)**, you choose whether Plerion can read the AWS resources you encrypt with your own customer managed AWS Key Management Service (KMS) keys. Plerion can decrypt with a key only if you allow it. Without that, the parts of a resource that the key protects stay hidden from Plerion. That is your choice to keep. The trade-off is that Plerion shows those resources only in part, and skips the checks and scans that need the hidden parts. If you want Plerion to show and check those resources in full, allow it for the keys you choose: * To show encrypted resource details, such as an Amazon Bedrock guardrail's filters, let the **Plerion access role** decrypt with the key. See [Read encrypted resource details](#read-encrypted-resource-details). * To scan encrypted workloads, such as volumes and images, give the **Plerion appliance role** access to the key. See [Workload scanning](#workload-scanning). *** ## Read encrypted resource details Some AWS services encrypt parts of a resource's settings with the resource's KMS key, and return those parts only to callers that can decrypt with the key. Amazon Bedrock and Amazon Bedrock AgentCore do this, for example for an AgentCore policy's Cedar statement, a memory's custom prompts, a guardrail's filters, or an agent's instructions. When the key is a customer managed key, AWS refuses to show these parts to the Plerion access role. Plerion still lists the resource, but its asset page says that Plerion can't read part of it, and the checks that need those parts are skipped. To see those parts in Plerion, let the Plerion access role decrypt with the key. Otherwise nothing changes, and Plerion keeps showing the resource in part. ### Let the Plerion access role decrypt with a key First, copy the ARN of the Plerion access role. In the IAM console, open **Roles**, find the role whose name ends in `PlerionAccessRole`, and copy its **ARN**. Then add these two statements to the `Statement` list of the key's policy. Replace `` with the ARN you copied, `` with your AWS account ID, and `` with the key's region. ```json theme={"system"} { "Sid": "AllowPlerionAccessRoleViaBedrock", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "kms:Decrypt", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "" }, "ArnEquals": { "aws:PrincipalArn": "" }, "StringLike": { "kms:ViaService": [ "bedrock..amazonaws.com", "bedrock-agentcore..amazonaws.com" ] } } }, { "Sid": "AllowPlerionAccessRoleCalledViaBedrock", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "kms:Decrypt", "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalAccount": "" }, "ArnEquals": { "aws:PrincipalArn": "" }, "ForAnyValue:StringEquals": { "aws:CalledVia": ["bedrock.amazonaws.com", "bedrock-agentcore.amazonaws.com"] } } } ``` 1. In the AWS KMS console, open **Customer managed keys** and choose the key. 2. On the **Key policy** tab, choose **Switch to policy view** if the console shows the default view, then choose **Edit**. 3. Add both statements to the `Statement` list, and choose **Save changes**. Plerion reads the data on the integration's next scan. The statements let only your Plerion access role decrypt with this key, and only when Amazon Bedrock or Amazon Bedrock AgentCore asks KMS on its behalf. The role cannot call KMS directly to decrypt with the key, and other AWS services, such as Amazon S3, cannot decrypt with it on the role's behalf. Bedrock and AgentCore reach KMS in two ways, so both statements are needed: for example, AgentCore memories need the first and AgentCore policies need the second. This lets the Plerion access role read the decrypted Bedrock and AgentCore settings that the key protects. That is a narrow exception to the read-only posture access described in the [security review](/guides/integrations/aws/aws-account/security-review). *** ## Workload scanning With this guide, you can grant Plerion appliances access to your customer managed AWS KMS (Key Management Service) keys. This access allows the **Cloud Workload Protection Platform (CWPP)** appliance to scan encrypted resources. For steps to enable or update the CWPP integration, see: 1. [Onboarding CWPP integration](/guides/integrations/aws/aws-account/getting-started-with-aws-account#steps-to-enable-cwpp-for-your-aws-account-optional) 2. [Updating AWS integration](/guides/integrations/aws/aws-account/updating-aws-account) *** ## Access modes You can grant access in two modes, either during onboarding or when updating the AWS integration: 1. All KMS keys 2. Selected KMS keys KMS access mode configuration showing all keys and selected keys options ### All KMS keys mode In this mode, the Plerion appliance is granted access to all KMS keys in the account. You can restrict specific keys by tagging them with **`PlerionAccess: Denied`**. This is recommended if your account has a large number of KMS keys. Example IAM policy statement added to the `PlerionApplianceRole`: ```json theme={"system"} { "Effect": "Allow", "Sid": "PlerionKmsCmkAccess", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey", "kms:CreateGrant" ], "Resource": ["arn:aws:kms:*:*:key/*"], "Condition": { "StringNotEqualsIgnoreCase": { "aws:ResourceTag/PlerionAccess": "Denied" } } } ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.