What is CIEM (Cloud Infrastructure Entitlement Management)?
CIEM (Cloud Infrastructure Entitlement Management) determines the effective permissions of every identity in a cloud environment (human users, service accounts and machine identities) after policies, role chains, service control policies and permission boundaries are resolved. It then compares those permissions against what each identity used, to remove excess access and enforce least privilege.
CIEM at a glance
| Question | Answer |
|---|---|
| What does CIEM stand for? | Cloud Infrastructure Entitlement Management (pronounced "kim") |
| What does it analyse? | Effective permissions of users, roles, service accounts and machine identities |
| What does it find? | Unused admin access, privilege escalation paths, risky cross-account trust, stale credentials |
| What does it read? | IAM policies and trust relationships, plus cloud audit logs for actual usage |
| How is it different from CSPM? | CSPM checks how resources are configured; CIEM checks who can act on them |
| Where does it fit? | One component of a CNAPP, next to CSPM, CWPP and KSPM |
Why reading policies is not enough
Ask most teams who can delete the production database and you will get a confident answer that is wrong. Not because anyone is careless, but because cloud permissions do not resolve the way people read them.
A single effective permission can be the product of an identity policy, a resource policy, a permissions boundary, a service control policy, a session policy, and two or three role assumptions in between. Any one of those can grant or deny. Reading the attached policy on a role tells you very little about what that role can reach.
CIEM computes the answer instead of reading it.
The two questions CIEM answers
1. What can this identity actually do?
Full resolution across the identity graph, including transitive access. If role A can assume role B, and role B can read the production bucket, then role A can read the production bucket. This is where cross-account trust chains and federation hops matter, and where most privilege escalation happens.
2. What has it used?
Effective permissions are compared against real usage from cloud audit logs, typically over a 90-day window. The gap between granted and used is the excess.
In most estates that gap is large, because permissions are added when something breaks and rarely removed when it stops. Every unused permission is attack surface with no operational benefit. It is a door that exists only because someone attached a broad policy on a Friday and nothing ever removed it.
What CIEM finds
- Identities with administrative access that has never been used
- Roles that can be assumed by overly broad principals, including wildcards
- Cross-account trust relationships nobody remembers creating
- Service accounts with human-grade permissions
- Stale credentials and access keys that outlived the person or workload
- Privilege escalation paths: permission sets that let an identity grant itself more, such as
iam:PassRoleto an admin role - Federation hops where an identity provider account unlocks cloud access
- Kubernetes ServiceAccounts bound to cluster-admin, or able to read Secrets and exec into pods. This is the cluster side of the same problem, covered in What is KSPM?
CSPM vs CIEM
| CSPM | CIEM | |
|---|---|---|
| Focus | Resource configuration | Identities and their permissions |
| Question it answers | Is this resource configured safely? | Who can do what, and do they still need it? |
| Data it reads | Resource settings from cloud provider APIs | IAM policies, trust relationships, SCPs, boundaries, plus audit logs for usage |
| Typical findings | Public bucket, open security group, encryption off, logging disabled | Unused admin rights, escalation paths, risky cross-account trust, stale keys |
| How it judges a policy | Checks the policy document against rules, e.g. "no wildcard actions" | Resolves the effective result of every policy together, then compares it with real usage |
| Typical fix | Change a setting, usually in infrastructure as code | Remove or narrow permissions; right-size roles to what was used |
Why you need both. Most cloud breaches need two things: something reachable and something it can do once reached. CSPM finds the first: the exposed resource. CIEM finds the second: the permissions that turn one foothold into wider access. A public VM (CSPM) whose instance role can assume an admin role in another account (CIEM) is one attack path; seen in two separate tools, it is two medium findings that nobody connects. That is why both usually run inside a CNAPP with attack path analysis on top.
CIEM vs IAM
IAM is the cloud provider's system for defining identities and policies. It is the mechanism. CIEM is the analysis layer on top: it does not create permissions, it works out what the permissions you already created mean in aggregate, and which of them are unnecessary.
Native IAM tooling shows you what a policy says. CIEM shows you what it does.
CIEM vs PAM and IGA
- PAM (privileged access management) controls and brokers access to privileged accounts, with vaulting and session recording. It is a control.
- IGA (identity governance and administration) manages the joiner-mover-leaver lifecycle and access certifications, mostly for human users and business applications.
- CIEM analyses the entitlements already granted inside cloud platforms, including machine identities that PAM and IGA rarely see. It finds the excess and the escalation paths.
CIEM best practices
- Start with unused administrative access. It is the largest risk reduction for the least disruption.
- Resolve trust policies as well as permission policies. Who can assume a role matters as much as what the role can do.
- Treat machine identities as first-class. Service accounts and workload roles usually outnumber people and are reviewed far less.
- Right-size from observed usage over a long enough window to include monthly and quarterly jobs.
- Rotate or remove long-lived keys in favour of short-lived, federated credentials.
- Review continuously, because permissions drift every time something breaks and someone grants more.
Where CIEM fits
CIEM is one of the highest-value inputs to attack path analysis, because identity is how attackers move. A vulnerability (CWPP) gets an attacker onto one machine; entitlements determine whether that is a contained incident or a full compromise. That is why identity findings and posture findings need to sit on the same graph rather than in separate tools.
How Onam approaches entitlements
Onam evaluates identity alongside configuration in the same platform, across AWS, Azure, GCP, OCI, Alibaba Cloud, IBM Cloud and Kubernetes. In its rule catalogue, 1,459 rule definitions are tagged to the IAM domain. One honest limit: usage-based right-sizing depends on the audit logs you keep. Permissions used outside the retained window look unused.
- How Onam implements CIEM: effective permissions, escalation paths and access reviews
- What is a cloud attack path?
- What is CNAPP?
Frequently asked questions
What is CIEM?
CIEM (Cloud Infrastructure Entitlement Management) works out what every cloud identity (users, roles, service accounts) can do once all policies, role chains and guardrails are resolved. It compares that with what the identity used and flags the excess so it can be removed.
What does CIEM stand for?
CIEM stands for Cloud Infrastructure Entitlement Management. It is pronounced 'kim'. CIEM resolves and analyses the effective permissions of every identity in a cloud environment.
What is the difference between CSPM and CIEM?
CSPM checks how cloud resources are configured: public buckets, open security groups, encryption and logging. CIEM checks who can act on those resources, meaning the effective permissions of every identity compared with what each one uses. CSPM finds the exposed door; CIEM finds how far someone can go once through it.
Do I need both CSPM and CIEM?
Yes, for most cloud estates. Misconfigurations and excessive permissions combine into attack paths, and neither tool sees the other half. Running both on one data model, usually as part of a CNAPP, lets a finding be judged by what it leads to.
What is the difference between CIEM and IAM?
IAM is the cloud provider's mechanism for defining identities and attaching policies. CIEM is an analysis layer that computes what those policies permit once role chains, service control policies and permission boundaries are resolved, and compares that against what was used.
What is the difference between CIEM and PAM?
PAM (Privileged Access Management) controls and brokers access to privileged accounts, typically with vaulting and session recording. CIEM analyses entitlements already granted in cloud environments to find excess and escalation paths. PAM is a control; CIEM is an assessment.
How does CIEM know which permissions are unused?
By reading cloud audit logs (CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) over a rolling window, usually 90 days, and comparing the actions taken against the full set the identity is entitled to take.