Skip to main content
With Plerion-managed scanning, you can enable Cloud Workload Protection Platform (CWPP) for an AWS account by granting a single cross-account role. Plerion runs the scanning appliances in its own accounts, so there is no VPC or networking to configure. For background on the model, see the Plerion-managed scanning overview.
For a smoother onboarding experience, log in to your target AWS account in the AWS Management Console before starting the setup in Plerion.

​
Steps to enable Plerion-managed scanning

1

Go to Settings > Integrations

On the Plerion dashboard, go to Settings > Integrations.
Sidebar navigation with Settings expanded and Integrations highlighted
2

Add a single AWS account

Find AWS account and click the + button, then click Add single AWS account.
Integrations page with AWS account option and plus button to add an integration
3

Select capabilities

On the Select capabilities page:
  • CSPM and CIEM are required and selected by default. Also select Cloud workload protection platform (CWPP).
  • When CWPP is selected, the CWPP deployment strategy section appears with Plerion-managed service account already selected as the default and recommended option. Keep it selected.
Capabilities page with CWPP selected and Plerion-managed service account chosen as the CWPP deployment strategy
4

Grant Plerion access

Grant Plerion a cross-account role so it can read your AWS account.
  • Click Launch stack to open the Quick create stack page in AWS CloudFormation.
Grant Plerion access page in Automated mode with the Launch stack button
  • Keep the default parameters and acknowledge the required capabilities, then click Create stack.
AWS CloudFormation Quick create stack page
AWS CloudFormation Quick create stack page with default parameters and capabilities acknowledged
  • Return to Plerion. While the stack is being created, you will see a loader screen. Once it completes, the integration is added.
Plerion creating the AWS account integration
5

Select workload types

Under Workload Types, select the workloads to scan. The available types are Amazon EC2 Instance, Amazon Machine Image (AMI), AWS Lambda, Amazon ECS, and Amazon ECR. All are selected by default.
Workload Types section with Amazon EC2, AMI, AWS Lambda, Amazon ECS, and Amazon ECR selected
6

Select workload regions

Under Workload regions, Plerion lists the regions where it detected workloads, along with the Detected Workload types in each. Use each region’s toggle to set it to Enabled or Disabled. Use Advanced Settings to enable regions that do not currently have detected workloads.
Workload regions section with per-region Enabled and Disabled toggles and detected workloads
7

Review the first scan

Plerion triggers the first scan, which runs in Plerion-owned accounts.
  • Track progress under Settings > Integrations > Scans.
  • View results in the Findings dashboard once the scan completes.
Scans page listing completed CWPP and CSPM scans with status, type, and duration

​
Resources created in your account

Plerion-managed scanning is enabled through the standard AWS account access stack, which grants Plerion access for CSPM, CIEM, and CWPP. The CloudFormation stack creates the following resources:
ResourceResource typeDescription
PlerionAccessRoleAWS::IAM::RoleCross-account role Plerion assumes to read your AWS resource metadata.
PlerionPermissionsBoundaryAWS::IAM::ManagedPolicyPermissions boundary that caps the permissions of all Plerion roles and prevents privilege escalation.
PlerionInstanceProfileRoleAWS::IAM::RoleRole granting permission to scan the selected workloads. The Plerion-managed appliances assume this role to read your workloads; only scan results are sent to Plerion.
PlerionCSPMAccessPolicyAWS::IAM::ManagedPolicyRead-only permissions Plerion CSPM uses to query your account.
PlerionCSPMDenyPolicyAWS::IAM::ManagedPolicyExplicit denies that bound what Plerion can read.
PlerionWellArchitectedWritePolicyAWS::IAM::ManagedPolicyWrite permissions for Plerion to manage Well-Architected workloads.
PlerionAutoUpdateRoleAWS::IAM::RoleRole that lets Plerion update only Plerion-managed CloudFormation stacks. See Auto stack update.
PlerionAPILambdaExecutionRoleAWS::IAM::RoleExecution role for the onboarding Lambda function.
PlerionAPICallFunctionAWS::Lambda::FunctionLambda function that calls the Plerion API to finalize the integration.
PlerionAPICallCustom::PlerionAPICallCustom resource that triggers the onboarding API call.

​
Next steps