Sharing mechanisms
Plerion detects access through four mechanisms.Covered resource types
Coverage expands over time. Each resource type is listed under the mechanism Plerion uses to evaluate it.The Amazon ECR registry, AWS Glue Data Catalog, AWS X-Ray resource policy, and Amazon CloudWatch Logs resource policy are account and region-scoped policies. Plerion surfaces each as its own asset rather than as a policy on an individual resource.
Resource policies (62 types)
RAM shares (25 types)
Attribute shares (9 types)
Trust policies (1 type)
Only IAM roles carry a trust policy, soAWS::IAM::Role is the single resource type evaluated through this mechanism. Plerion reads the role’s AssumeRolePolicyDocument, including federated principals such as OIDC and SAML identity providers.
How Resource Control Policies change what you see
A resource-based policy can allow access that your organization’s Resource Control Policies (RCPs) already deny. Reporting that as external access would send you to fix something AWS is already blocking, so Plerion evaluates the applicable RCPs for each grant and takes them into account. Plerion reads the RCPs attached to your organization root and organizational units, works out which ones apply to the account that owns the resource, and matches eachDeny statement against the grant’s actions, principal, resource, and conditions. Three outcomes follow:
Each grant also records whether RCPs were evaluated for it at all, and whether one blocks it. Neither has a column in the grants table; both appear in the Export CSV file and on the access grants API. RCPs do not apply to IAM roles, so a role trust policy is always reported as not applicable.
A partly blocked grant appears as two rows in the grants table, because the two halves of it are classified differently and can be reviewed separately.
What Plerion does not evaluate
- Access with no AWS-side record of the recipient, such as IAM access keys or API keys. There is nothing on the AWS side that identifies who holds them.
- Service Control Policies (SCPs). An SCP restricts what identities in your own organization may do, not what a resource grants to someone else.
Related pages
- Resource access grants overview: How Plerion builds and classifies grants.
- External access: The grants that reach principals outside your organization.
- Access review: Assign grantees, record decisions, and keep an audit history.