Getting started with an AWS account - Plerion, Simplify Cloud Security

For a smoother onboarding experience, log in to your target AWS account in the AWS Management Console before starting the setup in Plerion.

Steps to enable CSPM and CIEM for your AWS account

On the Plerion dashboard, go to Settings > Integrations

Find AWS account and click the + button

Click Add single AWS account to continue with onboarding a single AWS account.
Click Add accounts using Multi-Account Onbooarding to add mutiple AWS accounts at once.

Select your desired capabilities

The CSPM and CIEM capabilities are selected by default.
Click Next to continue.

Choose your setup mode

You can grant Plerion access using either Automated (recommended) or Manual mode:

Automated mode (recommended)

Click Launch stack to open the Quick create stack page in AWS CloudFormation.
Keep the default parameters and acknowledge required capabilities, then click Create stack.
Return to Plerion. While the stack is being created, you’ll see a loader screen.
Once the stack completes, Plerion will automatically finalize the integration and trigger the first scan. If the account belongs to an AWS organization that is new to your tenant, Plerion holds it for approval instead. See Account approval.
The initial scan typically finishes in under 10 minutes for small accounts. You can track progress under Settings → Integrations → Scans, and view results in the Compliance, Well-Architected, and Findings dashboards.

Manual mode

Create an IAM role in your target AWS account that trusts Plerion.
Copy the Role ARN and paste it into the Plerion access role ARN field, then click Next.
Plerion will verify permissions and start the initial CSPM/CIEM scan automatically.
You can track progress under Settings > Integrations > Scans. When complete, you can view results in Compliance, Well-Architected, and Findings.

Account approval

Plerion holds a newly added AWS account for approval when it belongs to an AWS organization that no other account in your tenant belongs to. Held accounts are not scanned until an administrator approves them. This confirms that the account was added deliberately. An account is added and scanned as normal when:

It is the first AWS account in your tenant.
It belongs to the same AWS organization as an account you have already added.

An account is held for approval when:

It belongs to a different AWS organization.
It belongs to no AWS organization, and your tenant already contains accounts that do.
Plerion cannot determine which AWS organization it belongs to.

Plerion identifies your tenant’s AWS organization from scan results, so the first account in a new tenant has nothing to compare against and is always added as normal.

While an account is awaiting approval

The account is listed under Settings > Integrations with a Pending approval badge. Open the integration to see which account is waiting and, where Plerion could determine it, the AWS organization it belongs to. While an account is held:

It is not scanned, either on schedule or on demand. Scan now is disabled.
Cloud Detection and Response (CDR) is not enabled for the account. If CDR was requested during onboarding, the request is kept and applied once the account is approved.
Automatic stack updates skip the account.

Plerion does not send a notification when an account is held, and a held account does not expire. If an account onboarded successfully but has produced no findings, check its status under Settings > Integrations.

Approve an account

Any user with permission to modify integrations can approve an account, not only the user who added it. The onboarding stack can be launched by someone who is not a Plerion user, so approval is always performed by an existing administrator.

Go to Settings > Integrations and open the account

Accounts waiting on a decision carry a Pending approval badge.

Click Approve this account

The account becomes active and its first scan starts immediately. You do not need to wait for the next scheduled scan.

If you do not recognize the account, delete the integration instead of approving it.

Steps to enable CWPP for your AWS account (optional)

To enable CWPP during onboarding, choose one of the following deployment strategies:

Plerion-managed scanning (recommended): Plerion runs the scanning appliances in its own AWS accounts.
- You only grant a cross-account role. There is no VPC or networking to configure.
- See Plerion-managed scanning for detailed steps.
Service account: Launches Plerion appliances from a dedicated service account.
- Best option for ongoing customer-hosted workload protection at scale.
- See AWS service account setup for detailed steps.
Same account: Launches Plerion appliances directly in the AWS account being onboarded.
- Requires networking configuration (VPC, Subnet, and Security Groups) to allow appliance traffic.
- Use the provided CloudFormation template to simplify setup.

Select CWPP while onboarding an AWS account

On the Select capabilities page, select Cloud Workload Protection Platform (CWPP) and click Next.

Choose IAM role creation mode

Make sure you are signed in to the target AWS account. Choose either Automated (recommended) or Manual to create the IAM role that grants Plerion access.

Configure workloads

On the Workload configuration page, select which workloads to protect.
Supported options are Amazon Elastic Compute Cloud (EC2), AWS Lambda, Amazon Elastic Container Service (ECS), Amazon Elastic Container Registry (ECR), Amazon Machine Images (AMI)

Configure appliances and networking

On the Appliance configuration page, regions containing the selected workloads are displayed. For each region:
- Provide networking details (VPC, Subnet, and Security Group) that allow outbound access to the internet.
- Use the Validate button to test connectivity.
You can:
- Use the example CloudFormation template to create the required networking components (VPC, Subnet, Internet Gateway, Route Table, and Network ACL).
- Delegate to Plerion: Use a Plerion-managed template to automatically configure a single region. Multi-region delegation will be supported in a future update, but for now, use StackSets for multi-region deployments.

Review advanced settings

In Advanced settings, you can enable additional AWS regions that don’t currently have workloads.

Trigger scans and review appliances

Each CWPP integration first triggers a CSPM scan, followed by a CWPP scan. For every CWPP scan:

An appliance EC2 instance is launched in each enabled region.
The appliance scans workloads and then terminates automatically.

You can view workload and appliance details on the Integration information page.

Example CloudFormation template for network configuration

The following is an example CloudFormation template for network configuration. This template can be used to create a VPC, Subnet, Internet Gateway, Route Table, and Network ACL. Users can create a Stack following Creating a Stack or deploy to multiple regions using StackSets. Copy the following template and save it as a YAML file

copy

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  CidrBlockParameter:
    Type: String
    Default: '192.168.0.0/24'
    Description: 'CIDR block for Plerion Appliance VPC'

Resources:
  PlerionApplianceVPC:
    Type: AWS::EC2::VPC
    Properties:
      Tags:
        - Key: Owner
          Value: Plerion
        - Key: Purpose
          Value: PlerionCWPPAppliance
      CidrBlock: !Ref CidrBlockParameter
      EnableDnsSupport: true
      EnableDnsHostnames: true

  PlerionApplianceInternetGateway:
    Type: 'AWS::EC2::InternetGateway'
    Properties:
      Tags:
        - Key: Owner
          Value: Plerion
        - Key: Purpose
          Value: PlerionCWPPAppliance

  PlerionApplianceVPCGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      InternetGatewayId: !Ref PlerionApplianceInternetGateway
      VpcId: !Ref PlerionApplianceVPC

  PlerionAppliancePublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      Tags:
        - Key: Owner
          Value: Plerion
        - Key: Purpose
          Value: PlerionCWPPAppliance
      VpcId: !Ref PlerionApplianceVPC

  PlerionAppliancePublicRoute:
    DependsOn: PlerionApplianceVPCGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PlerionAppliancePublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref PlerionApplianceInternetGateway

  PlerionAppliancePublicSubnet01:
    Type: AWS::EC2::Subnet
    Properties:
      Tags:
        - Key: Owner
          Value: Plerion
        - Key: Purpose
          Value: PlerionCWPPAppliance
      MapPublicIpOnLaunch: true
      CidrBlock: !Ref CidrBlockParameter
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref 'AWS::Region'
      VpcId: !Ref PlerionApplianceVPC

  PlerionAppliancePublicSubnet01RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PlerionAppliancePublicSubnet01
      RouteTableId: !Ref PlerionAppliancePublicRouteTable

  PlerionApplianceNACL:
    Type: AWS::EC2::NetworkAcl
    Properties:
      Tags:
        - Key: Owner
          Value: Plerion
        - Key: Purpose
          Value: PlerionCWPPAppliance
      VpcId: !Ref PlerionApplianceVPC

  PlerionApplianceNACLPublicSubnet01Association:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      NetworkAclId: !Ref PlerionApplianceNACL
      SubnetId: !Ref PlerionAppliancePublicSubnet01

  PlerionApplianceNACLOutbound:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref PlerionApplianceNACL
      RuleNumber: 100
      Protocol: -1
      Egress: true
      RuleAction: allow
      CidrBlock: 0.0.0.0/0

  PlerionApplianceNACLInbound:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref PlerionApplianceNACL
      RuleNumber: 100
      Protocol: -1
      RuleAction: allow
      CidrBlock: 0.0.0.0/0

  PlerionApplianceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      Tags:
        - Key: Owner
          Value: Plerion
        - Key: Purpose
          Value: PlerionCWPPAppliance
      GroupDescription: Allow HTTPS egress
      VpcId: !Ref PlerionApplianceVPC
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

​Steps to enable CSPM and CIEM for your AWS account

​Automated mode (recommended)

​Manual mode

​Account approval

​While an account is awaiting approval

​Approve an account

​Steps to enable CWPP for your AWS account (optional)

​Example CloudFormation template for network configuration

Steps to enable CSPM and CIEM for your AWS account

Automated mode (recommended)

Manual mode

Account approval

While an account is awaiting approval

Approve an account

Steps to enable CWPP for your AWS account (optional)

Example CloudFormation template for network configuration