CIEM (Cloud Infrastructure Entitlement Management).

Public clouds expose thousands of fine-grained permissions across IAM users, roles, service principals, federated identities, and workload identities. CIEM tools (a category named by Gartner) inventory every effective permission, map it against actual usage, and surface excessive entitlements — for example, an IAM role granted s3:* but only ever calling GetObject. They also detect privilege-escalation paths (iam:PassRole, AssumeRole chains, policy-version edits), unused identities, and risky cross-account trust relationships.

Why entitlement sprawl is dangerous

The Capital One breach (2019) is the canonical case. Paige Thompson exploited a Server-Side Request Forgery flaw in a misconfigured ModSecurity WAF to reach the EC2 Instance Metadata Service and retrieve the temporary credentials of the WAF's IAM role. Because that role held far more S3 permissions than it needed, the stolen credentials could list and read roughly 106 million customer records — a textbook failure of least privilege that led to an $80M OCC fine and a $190M class-action settlement. CIEM exists precisely to find and shrink that kind of over-broad role before an attacker does.

The effective-permission problem is genuinely hard: AWS alone defines thousands of actions, and a principal's real access is the intersection of identity policies, resource policies, permission boundaries, session policies, and SCPs. CIEM computes that graph, then feeds outcomes into automated remediation, scoped roles, just-in-time elevation, and drift alerting. It is a core pillar of CNAPP, and most valuable in multi-cloud estates where AWS, Azure, and GCP permission models diverge.

flowchart TD
  A[Cloud identities: users, roles, service principals] --> B[CIEM ingests IAM policies + activity logs]
  B --> C[Compute effective permissions graph]
  C --> D{Excessive or risky?}
  D -->|unused / over-broad| E[Right-size to least privilege]
  D -->|escalation path| F[Alert: PassRole / AssumeRole chain]
  D -->|in use, scoped| G[Keep]
  E --> H[Just-in-time elevation]