CIEM (Cloud Infrastructure Entitlement Management)

Public clouds expose thousands of fine-grained permissions across IAM users, roles, service principals, federated identities, and workload identities. CIEM tools inventory every effective permission, map it against actual usage, and surface excessive entitlements — for example, an IAM role granted s3:* but only ever using GetObject. They also detect privilege-escalation paths (PassRole, AssumeRole chains), unused identities, and cross-account trust risks. Outcomes typically feed automated remediation, scoped roles, and just-in-time elevation. CIEM is a core pillar of CNAPP, especially valuable in multi-cloud environments where permission models differ between providers.