Getting started with an AWS service account

Setting up an AWS service account involves two main steps:

1. Setting up the permissions required to run Plerion infrastructure
2. Installing the infrastructure in the regions where you want to run workload scans

---

​

Step 1: Set up permissions

​

Limitations

• An AWS account can only be associated with one service account.
• Service accounts cannot be shared across tenants or organizations.
• A maximum of 5 service accounts can be created in a tenant. A service account that is awaiting approval counts toward this limit.

​

Resources created

Creating the CloudFormation stack will deploy:

​

Troubleshooting

Error: PlerionInstanceProfileRole already exists in the stack
Cause: This indicates the AWS account is already being used as a service account in another Plerion organization.
Fix: Remove the existing service account and stack, or use a different AWS account. Error: AWS account <account id> is already registered with Plerion by stack <stack id>. Update that stack, or delete it before launching another.
Cause: Only the stack that registered a service account can change it. A second permission stack in the same account is refused.
Fix: Update the existing stack instead, or delete it and then launch the new one.

---

​

Service account approval

Plerion holds a new service account for approval when it belongs to an AWS organization that no account in your tenant belongs to. The same rule applies to AWS accounts. This confirms that the service account was added deliberately, because the stack can be launched by someone who is not a Plerion user. A service account is enabled as normal when:

• It is the first account in your tenant.
• It belongs to the same AWS organization as an AWS account or service account you have already added.

A service account is held for approval when:

• It belongs to a different AWS organization.
• It belongs to no AWS organization, and your tenant already contains accounts that do.
• Plerion cannot determine which AWS organization it belongs to.

​

While a service account is awaiting approval

The service account is listed under Settings > Integrations with a Pending approval label. Open it to see the account and, where Plerion could determine it, the AWS organization it belongs to. While a service account is held:

• It is disabled and cannot be enabled.
• Enable region is disabled, and a region stack launched for the account fails with awaiting approval.
• Add account is disabled, and the account cannot be selected when linking a target account. No AWS account is scanned through it.

​

Approve a service account

Any user with permission to modify service accounts can approve one, not only the user who launched the stack. If you do not recognize the service account, delete it instead of approving it.

---

​

Step 2: Install infrastructure in regions

​

Resources created

Installing the CloudFormation template will create the following resources in each region:

​

Troubleshooting

Error: AWS::SQS::Queue with identifier plerion-appliance-scan-queue already exists
Cause: This occurs if Plerion infrastructure is already installed in that region.
Fix:

• Delete the existing infrastructure and retry; or
• Choose a different region

If the duplicate was accidental, delete the failed stack. Error: The Plerion service account for AWS account <account id> is awaiting approval. Approve it in the Plerion console, then relaunch this stack.
Cause: The service account has not been approved yet. See Service account approval.
Fix: Approve the service account in Plerion, delete the failed stack, then launch the region stack again.

---

​

Next step

• Linking target accounts to a service account