What is CIEM (Cloud Infrastructure Entitlement Management)?

Why reading policies is not enough

Ask most teams who can delete the production database and you will get a confident answer that is wrong. Not because anyone is careless, but because cloud permissions do not resolve the way people read them.

A single effective permission can be the product of an identity policy, a resource policy, a permissions boundary, a service control policy, a session policy, and two or three role assumptions in between. Any one of those can grant or deny. Reading the attached policy on a role tells you almost nothing about what that role can reach.

CIEM computes the answer instead of reading it.

The two questions CIEM answers

1. What can this identity actually do?

Full resolution across the identity graph — including transitive access. If role A can assume role B, and role B can read the production bucket, then role A can read the production bucket. This is where cross-account trust chains and federation hops matter, and where most privilege escalation actually lives.

2. What did it actually do?

Effective permissions are compared against real usage from cloud audit logs, typically over a 90-day window. The gap between granted and used is the excess.

That gap is consistently enormous. Industry analyses repeatedly find that the large majority of granted cloud permissions are never exercised. Every unused permission is attack surface with no operational benefit — a door that exists solely because someone attached a broad policy on a Friday and nothing ever removed it.

What CIEM finds

• Identities with administrative access that has never been used
• Roles that can be assumed by overly broad principals, including wildcards
• Cross-account trust relationships nobody remembers creating
• Service accounts with human-grade permissions
• Stale credentials and access keys that outlived the person or workload
• Privilege escalation paths — permission sets that let an identity grant itself more
• Federation hops where an identity provider account unlocks cloud access

CIEM vs IAM

IAM is the cloud provider's system for defining identities and policies. It is the mechanism. CIEM is the analysis layer on top: it does not create permissions, it works out what the permissions you already created actually mean in aggregate, and which of them are unnecessary.

Native IAM tooling shows you what a policy says. CIEM shows you what it does.

Where CIEM fits

CIEM is one of the highest-value inputs to attack path analysis, because identity is how attackers move. A vulnerability gets an attacker onto one machine; entitlements determine whether that is a contained incident or a full compromise. That is why identity findings and posture findings need to sit on the same graph rather than in separate tools.

Next steps

• How Onam implements CIEM — effective permissions across seven clouds
• What is a cloud attack path?
• What is CNAPP?