> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Getting started with an AWS account
> Learn how to connect a single Amazon Web Services (AWS) account to Plerion for CSPM, CIEM, and CWPP capabilities.
For a smoother onboarding experience, log in to your **target AWS account** in the AWS Management Console before starting the setup in Plerion.
## Steps to enable CSPM and CIEM for your AWS account
Click `Add single AWS account` to continue with onboarding a single AWS account.\
Click `Add accounts using Multi-Account Onbooarding` to add mutiple AWS accounts at once.
The CSPM and CIEM capabilities are selected by default.\
Click `Next` to continue.
You can grant Plerion access using either **Automated** *(recommended)* or **Manual** mode:
### Automated mode (recommended)
* Click `Launch stack` to open the **Quick create stack** page in AWS CloudFormation.
* Keep the default parameters and acknowledge required capabilities, then click `Create stack`.
* Return to Plerion. While the stack is being created, you’ll see a loader screen.
* Once the stack completes, Plerion will automatically finalize the integration and trigger the first scan. If the account belongs to an AWS organization that is new to your tenant, Plerion holds it for approval instead. See [Account approval](#account-approval).
* The initial scan typically finishes in under 10 minutes for small accounts. You can track progress under `Settings` → `Integrations` → `Scans`, and view results in the **Compliance**, **Well-Architected**, and **Findings** dashboards.
### Manual mode
* Create an IAM role in your target AWS account that trusts Plerion.
* Copy the **Role ARN** and paste it into the **Plerion access role ARN** field, then click `Next`.
* Plerion will verify permissions and start the initial **CSPM/CIEM** scan automatically.
* You can track progress under `Settings` > `Integrations` > `Scans`. When complete, you can view results in **Compliance**, **Well-Architected**, and **Findings**.
***
## Account approval
Plerion holds a newly added AWS account for approval when it belongs to an AWS organization that no other account in your tenant belongs to. Held accounts are not scanned until an administrator approves them. This confirms that the account was added deliberately.
An account is added and scanned as normal when:
* It is the first AWS account in your tenant.
* It belongs to the same AWS organization as an account you have already added.
An account is held for approval when:
* It belongs to a different AWS organization.
* It belongs to no AWS organization, and your tenant already contains accounts that do.
* Plerion cannot determine which AWS organization it belongs to.
Plerion identifies your tenant's AWS organization from scan results, so the first account in a new tenant has nothing to compare against and is always added as normal.
### While an account is awaiting approval
The account is listed under `Settings` > `Integrations` with a **Pending approval** badge. Open the integration to see which account is waiting and, where Plerion could determine it, the AWS organization it belongs to.
While an account is held:
* It is not scanned, either on schedule or on demand. `Scan now` is disabled.
* Cloud Detection and Response (CDR) is not enabled for the account. If CDR was requested during onboarding, the request is kept and applied once the account is approved.
* [Automatic stack updates](/guides/platform/auto-stack-update) skip the account.
Plerion does not send a notification when an account is held, and a held account does not expire. If an account onboarded successfully but has produced no findings, check its status under `Settings` > `Integrations`.
### Approve an account
Any user with permission to modify integrations can approve an account, not only the user who added it. The onboarding stack can be launched by someone who is not a Plerion user, so approval is always performed by an existing administrator.
Accounts waiting on a decision carry a **Pending approval** badge.
The account becomes active and its first scan starts immediately. You do not need to wait for the next scheduled scan.
If you do not recognize the account, delete the integration instead of approving it.
***
## Steps to enable CWPP for your AWS account (optional)
To enable CWPP during onboarding, choose one of the following deployment strategies:
* **Plerion-managed scanning** *(recommended)*: Plerion runs the scanning appliances in its own AWS accounts.
* You only grant a cross-account role. There is no VPC or networking to configure.
* See [Plerion-managed scanning](/guides/integrations/aws/managed-scanning/overview) for detailed steps.
* **Service account**: Launches Plerion appliances from a dedicated service account.
* Best option for ongoing customer-hosted workload protection at scale.
* See [AWS service account setup](/guides/integrations/aws/service-account/getting-started-with-aws-service-account) for detailed steps.
* **Same account**: Launches Plerion appliances directly in the AWS account being onboarded.
* Requires networking configuration (VPC, Subnet, and Security Groups) to allow appliance traffic.
* Use the provided CloudFormation template to simplify setup.
On the **Select capabilities** page, select **Cloud Workload Protection Platform (CWPP)** and click `Next`.
Make sure you are signed in to the target AWS account. Choose either **Automated** (recommended) or **Manual** to create the IAM role that grants Plerion access.
* On the **Workload configuration** page, select which workloads to protect.
* Supported options are **Amazon Elastic Compute Cloud (EC2)**, **AWS Lambda**, **Amazon Elastic Container Service (ECS)**, **Amazon Elastic Container Registry (ECR)**, **Amazon Machine Images (AMI)**
* On the **Appliance configuration** page, regions containing the selected workloads are displayed. For each region:
* Provide networking details (VPC, Subnet, and Security Group) that allow outbound access to the internet.
* Use the `Validate` button to test connectivity.
You can:
* **Use the example CloudFormation template** to create the required networking components (VPC, Subnet, Internet Gateway, Route Table, and Network ACL).
* **Delegate to Plerion**: Use a Plerion-managed template to automatically configure a single region. Multi-region delegation will be supported in a future update, but for now, use [StackSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html) for multi-region deployments.
In **Advanced settings**, you can enable additional AWS regions that don’t currently have workloads.
Each CWPP integration first triggers a CSPM scan, followed by a CWPP scan. For every CWPP scan:
* An appliance **EC2 instance** is launched in each enabled region.
* The appliance scans workloads and then terminates automatically.
You can view workload and appliance details on the **Integration information** page.
***
### Example CloudFormation template for network configuration
The following is an example CloudFormation template for network configuration. This template can be used to create a VPC, Subnet, Internet Gateway, Route Table, and Network ACL.
Users can create a Stack following [Creating a Stack](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html) or deploy to multiple regions using [StackSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html).
Copy the following template and save it as a YAML file
```yaml filename="YAML" copy theme={"system"}
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
CidrBlockParameter:
Type: String
Default: '192.168.0.0/24'
Description: 'CIDR block for Plerion Appliance VPC'
Resources:
PlerionApplianceVPC:
Type: AWS::EC2::VPC
Properties:
Tags:
- Key: Owner
Value: Plerion
- Key: Purpose
Value: PlerionCWPPAppliance
CidrBlock: !Ref CidrBlockParameter
EnableDnsSupport: true
EnableDnsHostnames: true
PlerionApplianceInternetGateway:
Type: 'AWS::EC2::InternetGateway'
Properties:
Tags:
- Key: Owner
Value: Plerion
- Key: Purpose
Value: PlerionCWPPAppliance
PlerionApplianceVPCGatewayAttachment:
Type: 'AWS::EC2::VPCGatewayAttachment'
Properties:
InternetGatewayId: !Ref PlerionApplianceInternetGateway
VpcId: !Ref PlerionApplianceVPC
PlerionAppliancePublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
Tags:
- Key: Owner
Value: Plerion
- Key: Purpose
Value: PlerionCWPPAppliance
VpcId: !Ref PlerionApplianceVPC
PlerionAppliancePublicRoute:
DependsOn: PlerionApplianceVPCGatewayAttachment
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PlerionAppliancePublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref PlerionApplianceInternetGateway
PlerionAppliancePublicSubnet01:
Type: AWS::EC2::Subnet
Properties:
Tags:
- Key: Owner
Value: Plerion
- Key: Purpose
Value: PlerionCWPPAppliance
MapPublicIpOnLaunch: true
CidrBlock: !Ref CidrBlockParameter
AvailabilityZone: !Select
- 0
- Fn::GetAZs: !Ref 'AWS::Region'
VpcId: !Ref PlerionApplianceVPC
PlerionAppliancePublicSubnet01RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PlerionAppliancePublicSubnet01
RouteTableId: !Ref PlerionAppliancePublicRouteTable
PlerionApplianceNACL:
Type: AWS::EC2::NetworkAcl
Properties:
Tags:
- Key: Owner
Value: Plerion
- Key: Purpose
Value: PlerionCWPPAppliance
VpcId: !Ref PlerionApplianceVPC
PlerionApplianceNACLPublicSubnet01Association:
Type: AWS::EC2::SubnetNetworkAclAssociation
Properties:
NetworkAclId: !Ref PlerionApplianceNACL
SubnetId: !Ref PlerionAppliancePublicSubnet01
PlerionApplianceNACLOutbound:
Type: AWS::EC2::NetworkAclEntry
Properties:
NetworkAclId: !Ref PlerionApplianceNACL
RuleNumber: 100
Protocol: -1
Egress: true
RuleAction: allow
CidrBlock: 0.0.0.0/0
PlerionApplianceNACLInbound:
Type: AWS::EC2::NetworkAclEntry
Properties:
NetworkAclId: !Ref PlerionApplianceNACL
RuleNumber: 100
Protocol: -1
RuleAction: allow
CidrBlock: 0.0.0.0/0
PlerionApplianceSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
Tags:
- Key: Owner
Value: Plerion
- Key: Purpose
Value: PlerionCWPPAppliance
GroupDescription: Allow HTTPS egress
VpcId: !Ref PlerionApplianceVPC
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 443
ToPort: 443
CidrIp: 0.0.0.0/0
```
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.