CIEM — Cloud Identity & Entitlement Management
CIEM works out what each cloud identity can do, how it could escalate, who outside your account can get in and, on AWS, what it never uses.
CIEM has its own documentation section. Start here:
| Page | What it covers |
|---|---|
| CIEM overview | What CIEM answers, the CIEM screen, how it relates to IAM Security |
| How effective permissions are computed | Group expansion, condition classes, deny netting, SCP checks — and what is not modelled yet |
| Finding types | Escalation, shadow admins, trust, usage-based and database identity findings, by cloud |
| Reading the identity graph | The edges CIEM writes and where you read them |
| Right-sizing workflow | Risk score, permission gap, access reviews and making the change |
| Per-cloud notes | What runs on AWS, Azure, GCP, Kubernetes, OCI, Alibaba Cloud and IBM Cloud |
In one paragraph
CIEM reads identities, policies and trust settings from the inventory Onam's posture scan already builds. It resolves each identity's effective access — on AWS through group expansion, condition classification, explicit-deny netting and SCP deny checks — and writes identity relationships into the platform's security graph. Detectors then find escalation paths, shadow admins and risky trust. On AWS, CloudTrail activity collected by threat detection is compared with granted actions to measure each identity's permission gap, every identity gets a 0–100 risk score, and high-tier identities open an access review. CIEM never changes your IAM.
Next steps
- IAM Security — identity hygiene: MFA, keys, password policy, root usage
- Attack Path Analysis — identity edges combined with network and data exposure
- CDR — the activity that confirms escalation and feeds unused-permission analysis