​
Entitlements Analyzer Coverage

This document serves as a reference for the coverage of the Plerion Entitlements Analyzer feature.

​
Supported Provider

AWS only

​
Supported Identities

Identity TypeSupport
AWS IAM Role✅
AWS IAM User✅
AWS IAM Group✅

​
Supported policy types

Policy TypeSupport
Inline policy✅
Managed Policy (Custom / AWS Managed)✅
Permissions boundary✅
Resource based policy❌
Group Linked Policies❌
SCPs❌
VPC Endpoint policies❌

​
ABAC Support

TypeSupport
Properties of the principalPartial
Properties of the resourcePartial (aws:ResourceAccount, aws:ResourceTag/tag::key)
Properties of a role session❌
Properties of the network❌
Properties of the request❌

​
Supported resource types

  • AWS::Lambda::Function
  • AWS::EC2::InternetGateway
  • AWS::EC2::Subnet
  • AWS::EC2::RouteTable
  • AWS::EC2::NetworkAcl
  • AWS::EC2::Instance
  • AWS::IAM::InstanceProfile
  • AWS::EC2::NetworkInterface
  • AWS::IAM::Role
  • AWS::IAM::Policy
  • AWS::ApiGatewayV2::Api
  • AWS::ApiGatewayV2::Route
  • AWS::DynamoDB::Table
  • AWS::ECS::Service
  • AWS::ECS::Cluster
  • AWS::ECS::TaskDefinition
  • AWS::EC2::SecurityGroup
  • AWS::S3::Bucket
  • AWS::RDS::DBCluster
  • AWS::EC2::VPC
  • AWS::APIGateway::RestAPI
  • AWS::ApiGatewayV2::Integration
  • AWS::APIGateway::Resource
  • AWS::APIGateway::Integration
  • AWS::RDS::DBInstance
  • AWS::ElasticLoadBalancingV2::Listener
  • AWS::AutoScaling::LaunchConfiguration
  • AWS::EC2::LaunchTemplate
  • AWS::AutoScaling::AutoScalingGroup
  • AWS::ElasticLoadBalancingV2::LoadBalancer
  • AWS::ElasticLoadBalancingV2::TargetGroup
  • AWS::EC2::LaunchTemplateVersion
  • AWS::RDS::DBSecurityGroup
  • AWS::IAM::User
  • AWS::IAM::Group
  • AWS::KMS::Key
  • AWS::EC2::Volume
  • AWS::EC2::AMI
  • AWS::SQS::Queue
  • AWS::EventBridge::EventBus
  • AWS::ECR::Repository
  • AWS::CloudTrail::Trail
  • AWS::EC2::Snapshot
  • AWS::RDS::DBClusterSnapshot
  • AWS::Backup::BackupVault
  • AWS::SecretsManager::Secret
  • AWS::SNS::Topic
  • AWS::SageMaker::Notebook
  • AWS::Neptune::DBCluster
  • AWS::Neptune::DBInstance
  • AWS::Lambda::Layer
  • AWS::SES::EmailIdentity

​
Limitations

  • Currently permissions associated with S3 bucket objects like s3:GetObject, s3:WriteObject etc aren’t supported