Onam
IAM Security

Are my identities configured safely — MFA, keys, passwords, root?

Identity hygiene, checked on every scan across every cloud.

IAM Security is the configuration-hygiene view of Onam's identity engine: MFA, access keys, password policy, root usage, wildcard policies and trust settings, scored per module. For effective permissions, escalation paths and unused access, see CIEM — same engine, same inventory.

See it in my cloud Read the docs
9,853
posture rules
7
cloud providers
549
cloud services
78
compliance frameworks
Why it mattersHow it worksWhat you getFAQ
Why this matters

An engineer leaves the company and their access key keeps working.

Root MFA was switched off during a migration and never switched back on. A wildcard policy attached for a one-off script is still on a shared role. None of this needs graph analysis to find — it needs every identity checked, on every scan, in every cloud, and the result kept somewhere people look.

The risk of not knowing

If it is not surfaced today, it is exposed today. Attackers do not wait for your quarterly review — and neither do auditors.

Re-checked on every scan, not once a quarter
How does it actually work?

The mechanism, not the marketing

  1. 1

    After each posture scan, the identity engine loads the findings of every rule scoped to identity security — IAM, MFA, password, root, SSO, Entra ID, RBAC, PIM, service principals, managed identities, service accounts and workload identity — and adds its own detections.

  2. 2

    Each finding is assigned to one of six modules: least privilege, policy analysis, MFA, role management, password policy and access control.

  3. 3

    Provider analysers add identity checks per cloud — for example key and token rotation and dynamic-group scope on OCI, RAM trust and MFA conditions on Alibaba Cloud, and trusted profiles and access groups on IBM Cloud.

  4. 4

    The IAM Security screen rolls this up into a posture score, findings by severity, an identity risk trend and an Effective Access panel for looking up any single principal.

  5. 5

    The same identities and findings feed CIEM, where effective permissions, escalation paths, unused access and access reviews are worked out.

What do you actually get?

Specific outputs, measurable outcomes

MFA coverage
users and privileged identities without MFA
Access-key and credential age
keys and tokens past rotation thresholds
Root account usage
root activity and root access keys
Policy hygiene
wildcard actions and resources, admin policies, inline policies
Password policy
minimum length and expiry against CIS and NIST guidance
Trust settings
wildcard trust principals and cross-account roles without ExternalId
Six IAM modules
each with its own summary and pass rate
Effective Access lookup
search any principal and see what it can do after explicit denies and SCP denies
FAQ

Questions we get a lot

IAM Security checks each identity's configuration — is MFA on, are keys rotated, is the policy a wildcard. CIEM resolves what each identity can actually do, how it could escalate and what it never uses. Both run on Onam's one identity engine and share one inventory: IAM Security is the hygiene view, CIEM the entitlement view.
Ready to see it live

Ready to see IAM Security in your cloud?

Connect a read-only role in three minutes. Your first findings surface in under five.

Book a live demo →See pricing
Related capabilities
CIEM — effective permissions & escalationCIEM documentationCSPMThreat Detection