> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Coverage

> The AWS resource types and sharing mechanisms Plerion evaluates, and how Resource Control Policies change what you see

With **[resource access grants](https://app.plerion.com/entitlements/access-grants)**, Plerion evaluates access across a growing set of AWS resource types and sharing mechanisms. This page lists what is evaluated today.

***

## Sharing mechanisms

Plerion detects access through four mechanisms.

| Mechanism | What it is |
| - | - |
| **Resource policy** | An IAM-policy-shaped resource-based policy attached to, or scoped to, the resource, such as an S3 bucket policy or a KMS key policy. |
| **Trust policy** | An IAM role's `AssumeRolePolicyDocument`, which controls who may assume the role. |
| **RAM share** | An AWS Resource Access Manager (RAM) resource share, evaluated as an equivalent IAM-shaped grant. |
| **Attribute share** | A cross-account permission set directly on the resource as an attribute, such as an AMI launch permission or an EBS, RDS, or Redshift snapshot restore permission, rather than as a policy document. Evaluated as an equivalent IAM-shaped grant. |

***

## Covered resource types

Coverage expands over time. Each resource type is listed under the mechanism Plerion uses to evaluate it.

<Note>
  The Amazon ECR registry, AWS Glue Data Catalog, AWS X-Ray resource policy, and Amazon CloudWatch Logs resource policy are account and region-scoped policies. Plerion surfaces each as its own asset rather than as a policy on an individual resource.
</Note>

### Resource policies (62 types)

| Service | Resource |
| - | - |
| Amazon API Gateway | REST API |
| Amazon Bedrock | Knowledge base |
| Amazon Bedrock AgentCore | Gateway |
| Amazon Bedrock AgentCore | Runtime |
| Amazon Bedrock AgentCore | Runtime endpoint |
| Amazon CloudWatch | Observability Access Manager sink |
| Amazon CloudWatch Logs | Account resource policy |
| Amazon CloudWatch Logs | Delivery destination |
| Amazon CloudWatch Logs | Destination |
| Amazon CloudWatch RUM | App monitor |
| Amazon DynamoDB | Table |
| Amazon ECR | Registry |
| Amazon ECR | Repository |
| Amazon EFS | File system |
| Amazon EventBridge | Event bus |
| Amazon EventBridge | Schema registry |
| Amazon Kinesis Data Streams | Data stream |
| Amazon Managed Service for Prometheus | Workspace |
| Amazon Managed Streaming for Apache Kafka (MSK) | Cluster |
| Amazon OpenSearch Service | Domain |
| Amazon Redshift Serverless | Namespace |
| Amazon Redshift Serverless | Snapshot |
| Amazon Rekognition | Project |
| Amazon S3 | Access Grants instance |
| Amazon S3 | Access point |
| Amazon S3 | Bucket |
| Amazon S3 | Directory bucket (S3 Express One Zone) |
| Amazon S3 | Directory bucket access point (S3 Express One Zone) |
| Amazon S3 | File system |
| Amazon S3 | Multi-Region Access Point |
| Amazon S3 | Table (S3 Tables) |
| Amazon S3 | Table bucket (S3 Tables) |
| Amazon S3 | Vector bucket (S3 Vectors) |
| Amazon SageMaker AI | Model package group |
| Amazon SES | Email identity |
| Amazon SNS | Topic |
| Amazon SQS | Queue |
| Amazon VPC Lattice | Resource configuration |
| Amazon VPC Lattice | Service |
| Amazon VPC Lattice | Service network |
| AWS Backup | Backup vault |
| AWS CloudTrail | Channel |
| AWS CloudTrail | Event data store |
| AWS CodeArtifact | Domain |
| AWS CodeArtifact | Repository |
| AWS CodeBuild | Build project |
| AWS Elemental MediaTailor | Channel |
| AWS Glue | Data Catalog |
| AWS HealthOmics | Sequence store |
| AWS Key Management Service (KMS) | KMS key |
| AWS Lambda | Function |
| AWS Lambda | Layer |
| AWS Secrets Manager | Secret |
| AWS Serverless Application Repository | Application |
| AWS Signer | Signing profile |
| AWS WAF | Rule group |
| AWS WAF Classic (global) | Rule group |
| AWS WAF Classic (regional) | Rule group |
| AWS X-Ray | Account resource policy |
| EC2 Image Builder | Component |
| EC2 Image Builder | Container recipe |
| EC2 Image Builder | Image recipe |

### RAM shares (25 types)

| Service | Resource |
| - | - |
| Amazon Bedrock | Custom model |
| Amazon EC2 | Placement group |
| Amazon RDS | DB cluster |
| Amazon Route 53 | Profile (Route 53 Profiles) |
| Amazon SageMaker AI | Catalog |
| Amazon SageMaker AI | Feature group |
| Amazon SageMaker AI | Hub |
| Amazon SageMaker AI | Model card |
| Amazon SageMaker AI | Pipeline |
| Amazon VPC | Managed prefix list |
| Amazon VPC | Security group |
| Amazon VPC | Subnet |
| Amazon VPC | Transit gateway |
| Amazon VPC | Transit gateway multicast domain |
| Amazon VPC IP Address Manager (IPAM) | Resource discovery |
| AWS App Mesh | Mesh |
| AWS AppSync | GraphQL API |
| AWS Cloud Map | HTTP namespace |
| AWS CodeBuild | Report group |
| AWS CodeConnections | Connection |
| AWS Network Firewall | Firewall policy |
| AWS Network Firewall | Rule group |
| AWS Resource Groups | Resource group |
| AWS Service Catalog AppRegistry | Application |
| AWS Service Catalog AppRegistry | Attribute group |

### Attribute shares (9 types)

| Service | Resource |
| - | - |
| Amazon DocumentDB | DB cluster snapshot |
| Amazon EBS | Snapshot |
| Amazon EC2 | Amazon Machine Image (AMI) |
| Amazon EC2 | FPGA image |
| Amazon Neptune | DB cluster snapshot |
| Amazon RDS | DB cluster snapshot |
| Amazon RDS | DB snapshot |
| Amazon Redshift | Cluster snapshot |
| AWS Systems Manager | Document |

### Trust policies (1 type)

Only IAM roles carry a trust policy, so `AWS::IAM::Role` is the single resource type evaluated through this mechanism. Plerion reads the role's `AssumeRolePolicyDocument`, including federated principals such as OIDC and SAML identity providers.

***

## How Resource Control Policies change what you see

A resource-based policy can allow access that your organization's Resource Control Policies (RCPs) already deny. Reporting that as external access would send you to fix something AWS is already blocking, so Plerion evaluates the applicable RCPs for each grant and takes them into account.

Plerion reads the RCPs attached to your organization root and organizational units, works out which ones apply to the account that owns the resource, and matches each `Deny` statement against the grant's actions, principal, resource, and conditions. Three outcomes follow:

| Outcome | What Plerion records |
| - | - |
| **Nothing blocked** | The grant keeps its origin. An outside principal stays `External`. |
| **Fully blocked** | The grant becomes `Internal` and is marked as blocked by an RCP. It stays in the inventory so you can still see what would be exposed if the RCP were removed. |
| **Partly blocked** | Plerion records the grant twice: an `Internal` entry holding the actions the RCP denies, and an `External` entry holding the actions that still get through. |

Each grant also records whether RCPs were evaluated for it at all, and whether one blocks it. Neither has a column in the grants table; both appear in the **Export CSV** file and on the [access grants API](/api-reference/). RCPs do not apply to IAM roles, so a role trust policy is always reported as not applicable.

<Note>
  A partly blocked grant appears as two rows in the grants table, because the two halves of it are classified differently and can be reviewed separately.
</Note>

***

## What Plerion does not evaluate

* **Access with no AWS-side record of the recipient**, such as IAM access keys or API keys. There is nothing on the AWS side that identifies who holds them.
* **Service Control Policies (SCPs).** An SCP restricts what identities in your own organization may do, not what a resource grants to someone else.

***

## Related pages

* [Resource access grants overview](/guides/platform/resource-access-grants/overview): How Plerion builds and classifies grants.
* [External access](/guides/platform/resource-access-grants/external-access): The grants that reach principals outside your organization.
* [Access review](/guides/platform/resource-access-grants/access-review): Assign grantees, record decisions, and keep an audit history.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.