> ## Documentation Index > Fetch the complete documentation index at: https://docs.plerion.com/llms.txt > Use this file to discover all available pages before exploring further. # Trusted principals > Manage the external principals you trust so Plerion stops flagging their grants With **[trusted principals](https://app.plerion.com/settings/profiles)**, you can record which external principals are expected to have access to your environment. Once a principal is trusted, its grants show as `Trusted` in the [resource access grants](/guides/platform/resource-access-grants/overview) inventory and no longer raise [untrusted external access findings](/guides/platform/resource-access-grants/findings). A **trusted principal** is an external principal you have confirmed is expected to have access. It can be an AWS account, a whole AWS organization, an IAM role or user, a Cognito identity pool, or a federated identity such as a GitHub OpenID Connect (OIDC) organization or a Security Assertion Markup Language (SAML) provider. Trusting a principal covers every grant it holds, on every resource, and does not expire. To accept one grant for a fixed period instead, use a [`Trust until review` decision](/guides/platform/resource-access-grants/access-review#trusting-a-grant-until-its-review-date) on that grant. *** ## Where to manage trusted principals Trusted principals are configured per detection profile, so different parts of your estate can apply different trust decisions. Go to `Settings` > `Profiles` and select the profile you want to edit. Open the **Trusted principals** tab to see and edit the principals trusted by that profile. Trusted principals tab showing the summary tiles and trusted principals table Only **Organization Admins** and **Tenant Admins** can add or remove principals. ### Inheritance from the default profile A profile that has never had its own trusted principals set inherits them from the tenant's default profile: * While it inherits, the table header notes how many entries are inherited and from which profile. * The first time you save a change on that profile, it keeps its own list and stops following the default. * Emptying a list is a decision Plerion keeps. A profile whose list you clear stays empty rather than falling back to the default. *** ## What the tab shows The tab opens with four summary tiles: **Trusted external principals**, **Suggested principals to trust**, **AWS principals**, and **Internal accounts**. The **Trusted external principals** table lists the principals this profile trusts. The help text states that these are *"External principals excluded from untrusted external access findings."* Each row shows: | Column | Description | | - | - | | **Principal** | The principal name and its identifier, such as an AWS account ID, an Amazon Resource Name (ARN), an AWS organization ID, or an OIDC subject and audience. | | **Type** | `AWS account`, `ARN`, `AWS organization`, `OIDC`, `SAML`, or `Cognito identity pool`. | | **Source** | How the entry was added: `Vendor`, `Manual`, `Cross-account`, `OIDC org`, or `Workforce IdP`. | | **Comment** | A free-text note of your own, up to 1024 characters. Select the cell to edit it. The comment is for your records and never affects which grants an entry covers. | | **Grants** | How many active access grants currently match this principal. | | **Actions** | A `Remove` button on entries you can edit. | Select `Export CSV` above the table to download the list, including each entry's type, identifier, source, and comment. *** ## Adding a trusted principal Use the **Add a trusted external principal** field to search for and add a principal. Its placeholder reads *"Search vendors, or paste an account ID, ARN or organization ID."* Select the field before typing and Plerion offers five templates under **Ways to add**, each showing the shape of a value it accepts: * **A known software-as-a-service (SaaS) vendor**: Start typing a vendor name, such as `Datadog`, and select it from the catalog of published vendor AWS account IDs. Plerion fills in the account ID for you. * **An AWS account ID**: A 12-digit ID, for example `123456789012`. Select `Add AWS account`. * **An AWS organization ID**: An ID in the form `o-abc123defg`. Select `Add AWS organization` to trust every account in a partner's organization. * **An IAM ARN**: A role or user ARN, for example `arn:aws:iam::123456789012:role/my-role`. Select `Add ARN`. * **A federated identity**: The provider shorthand, for example `github.com/myorg` or `gitlab.com/mygroup/myproject`. Plerion recognizes GitHub, GitLab, Buildkite, HCP Terraform, and CircleCI. Add a trusted external principal field showing vendor and OIDC suggestions Freeform text that does not match a vendor, account ID, organization ID, ARN, or recognized provider is not added. Select a suggestion or use one of the formats above. Adding or removing a principal changes a draft only. Nothing takes effect until you select `Update` at the bottom of the profile, and leaving the page first discards the change. After you save, classifications and findings update on the next scan. ### Wildcards in ARNs An ARN entry accepts `*` in the role or user name, so one entry can cover a family of roles. For example, `arn:aws:iam::123456789012:role/pl-*-auto-update-worker` matches every stage and region variant of that role. `*` is the only wildcard. Every other character is matched literally, including `?`, and the pattern has to match the whole ARN rather than part of it. ARNs in the `aws`, `aws-cn`, `aws-us-gov`, and AWS ISO partitions are all accepted. ### Bitbucket Bitbucket Pipelines is recognized in your grants but has no shorthand in the add field, because its audience value is specific to your workspace. Trust a Bitbucket identity from the **Suggested principals to trust** table or from the [finding's **Access grants** tab](/guides/platform/resource-access-grants/findings#the-access-grants-tab), where Plerion already has the values it needs. *** ## Suggested principals The **Suggested principals to trust** table lists *"External principals that have already been granted access multiple times and may be candidates to trust."* In practice, a principal is suggested when it holds **at least 10 active grants** and is not already trusted. For each suggestion you see the principal, its type, its AWS account, how many of your accounts it has access in, and its total number of grants. Select `Add` to move it into your trusted principals list. The button changes to `Added` once selected. Suggested principals to trust table listing each candidate with its AWS account, how many of your accounts it has access in, its grant count, and an Add button on each row Some principals are deliberately left out: * **Your own accounts.** Plerion compares suggestions against the AWS accounts you have onboarded and drops anything that names one of them. * **Wildcard principals.** A `*` principal is access to fix, not a principal to trust. * **AWS service principals.** These appear under **AWS principals** instead. * **Broad identity providers.** A federated grant that names a shared provider host without narrowing to your own organization is not suggested. Trusting it would cover every customer of that provider, not just you. OIDC suggestions are grouped by organization rather than by workload, so a CI provider federating into several of your accounts appears as one row you can trust in a single step, instead of one row per repository or branch. A suggestion shows no `Add` button when Plerion cannot rebuild a complete trust entry from the grant alone. This affects Cognito grants with no resolvable identity pool, OIDC grants whose provider Plerion does not recognize, and every SAML principal. The finding's **Access grants** tab builds its entry the same way, so a principal with no button here has none there either. Where the provider has a shorthand, type it into the add field instead. SAML principals cannot be added by any route today. Suggestions are calculated by comparing grants against your own AWS accounts, so Plerion needs at least one onboarded AWS account or AWS Organization to produce them. If your accounts cannot be loaded, the tab says so rather than showing a partial list. *** ## Principals Plerion trusts for you Some principals are trusted without you adding them. * **AWS principals**: AWS-owned service principals (`*.amazonaws.com`), described in the tab as *"Implicitly trusted and cannot be edited."* * **Internal accounts**: *"AWS accounts in your Organization or integrated with Plerion. Implicitly trusted and cannot be edited."* This covers two groups: accounts in the same AWS organization as the resource, and accounts you have onboarded to Plerion even when they sit in a different AWS organization. An onboarded outside account keeps its true `Cross-org` scope in the inventory, so you can still see the account boundary, but it raises no finding. * **AWS Support**: The AWS Support principal used to restore Amazon Redshift snapshots is always trusted. Expand either the **AWS principals** or **Internal accounts** section to review what Plerion has classified this way. ### Plerion's own accounts Your tenant's default profile starts with two entries for Plerion's own access, shown with a `Vendor` source: | Entry | What it is | | - | - | | **Plerion** | The AWS account Plerion uses to reach your integrations. | | **Plerion auto-update roles** | The role pattern used by the [auto stack update](/guides/platform/auto-stack-update) worker, across every stage and region. | Without these, Plerion's own access to your accounts would be reported as untrusted external access on every resource it touches. *** ## Removing a trusted principal Select `Remove` on the principal's row in the **Trusted external principals** table, then select `Update` to save as you would for an addition. Inherited entries and implicitly trusted principals have no `Remove` button. Neither do the two Plerion entries described above, so Plerion's own access to your accounts cannot be untrusted from this tab. *** ## Related pages * [Resource access grants](/guides/platform/resource-access-grants/overview): The inventory of every grant to a principal. * [External access](/guides/platform/resource-access-grants/external-access): The grants that reach outside your organization. * [Access review](/guides/platform/resource-access-grants/access-review): Record a decision on one grant, or trust it until its review date. * [Untrusted external access findings](/guides/platform/resource-access-grants/findings): What happens to external grants that are not yet trusted. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.