# Top 7 Open-Source Cloud Entitlement and CIEM Tools Source: https://startwithidentity.com/articles/top-7-open-source-cloud-entitlement-ciem-tools/ Last updated: 2026-08-29 License: content by Start with Identity. Cite the source URL. --- Ask a competent engineer what a specific service principal can actually do across your cloud accounts, and without tooling they cannot tell you. That is not incompetence: in AWS alone the effective answer depends on identity policies, resource policies, permission boundaries, service control policies, session policies, and role chaining, and it is a computation rather than a lookup. [Cloud infrastructure entitlement management](https://startwithidentity.com/guides/fundamentals/what-is-ciem/) exists because of that gap. The open-source ecosystem here is strong on discovery and analysis, which is the expensive part to build and the cheapest part to buy incorrectly. Running these tools first tells you how large your problem actually is, which is a much better basis for a commercial CIEM decision than a vendor demo. For the commercial landscape see the [CIEM vendor category](https://startwithidentity.com/vendors/ciem/) and [Wiz vs Sonrai Security](https://startwithidentity.com/compare/wiz-vs-sonrai-security/). ## Evaluation Criteria We assessed each tool against the following dimensions: - **Cloud coverage**, AWS only versus multi-cloud - **What it finds**, misconfiguration, over-permission, or escalation paths - **Analysis depth**, policy parsing versus graph traversal - **Output usability**, prioritized findings versus raw data - **Automation**, CI integration and scheduled scanning - **Remediation support**, whether it helps generate the fix - **Maintenance**, project health and update cadence ## The Top 7 Open-Source Cloud Entitlement Tools ### 1. Prowler **Best For:** Broad multi-cloud security assessment with a large check library, including IAM. **Overview** Prowler is the most widely used open-source cloud security assessment tool, covering AWS, Azure, GCP, and Kubernetes with hundreds of checks mapped to CIS benchmarks and other frameworks. Identity and access checks are a substantial part of that library: unused credentials, missing MFA on privileged accounts, over-permissive policies, and root account hygiene. It is the reasonable starting point because it gives you breadth quickly. **Key Features** - Multi-cloud: AWS, Azure, GCP, and Kubernetes - Hundreds of checks mapped to CIS and other compliance frameworks - Multiple output formats for pipelines and dashboards - Continuous scanning support and CI integration - Active development with a commercial hosted option **License** Apache 2.0. **Pros** - Breadth of coverage across clouds and check types - Compliance framework mapping makes the output immediately useful to auditors - Large, active community **Cons** - Breadth over depth: not a dedicated entitlement analysis engine - Large output requires triage discipline - Does not compute escalation paths the way graph tools do --- ### 2. Cloudsplaining **Best For:** Finding AWS IAM policies that violate least privilege, with a readable report. **Overview** Cloudsplaining from Salesforce parses AWS IAM policies and identifies least-privilege violations, flagging policies that grant resource exposure, privilege escalation potential, credentials exposure, or data exfiltration capability. It produces a risk-prioritized HTML report rather than a raw list, which makes it unusually good at turning analysis into a work queue people will act on. **Key Features** - AWS IAM policy parsing with least-privilege violation detection - Risk categories: resource exposure, privilege escalation, credential exposure, data exfiltration - Prioritized HTML report designed to be shared - Exclusions file for accepted risks - Offline analysis of downloaded policy documents **License** Apache 2.0. **Pros** - Output is genuinely readable and prioritized, which drives remediation - Offline analysis means no live account access required - Focused specifically on the least-privilege question **Cons** - AWS only - Policy-level analysis, so it does not resolve full effective permissions across role chains - Needs an exclusions strategy or repeat findings become noise --- ### 3. PMapper **Best For:** Finding actual privilege escalation paths in an AWS account. **Overview** PMapper (Principal Mapper) builds a graph of IAM principals and the edges between them, analyzing trust policies, resource-based policies, and the specific API calls that enable escalation, then answers questions such as which principals can reach administrative access and by what route. In comparative testing it has shown the highest privilege escalation detection rate among the common open-source options. **Key Features** - Graph model of principals and escalation edges - Query interface for "who can reach what" questions - Analyzes trust policies and resource-based policies, not just identity policies - Visualization of escalation paths - Simulates authorization decisions **License** Open source (AGPL-3.0). **Pros** - Computes real escalation paths rather than flagging risky-looking policies - Query model answers the questions security teams actually ask - Strongest detection rate in comparative evaluations **Cons** - AWS only - Command-line and query oriented, with no polished report - Graph construction takes time on large accounts --- ### 4. policy_sentry **Best For:** Generating least-privilege IAM policies instead of hand-writing wildcards. **Overview** policy_sentry inverts the usual workflow: rather than auditing a bad policy after the fact, you declare the resources and access levels a workload needs and it generates a least-privilege IAM policy with correct actions and resource ARNs. It exists because writing least-privilege policies by hand is tedious enough that engineers reach for wildcards, and wildcards are the finding every audit produces. **Key Features** - Generates IAM policies from a declarative YAML template - Access-level abstraction (read, write, list, tagging, permissions management) - Resource ARN construction from a simple specification - Query interface for the AWS IAM action database - CI-friendly for policy generation in pipelines **License** MIT. **Pros** - Attacks the root cause rather than the symptom - Makes least privilege the path of least resistance for engineers - Useful as a reference for what actions exist and what they do **Cons** - AWS only - Requires knowing what access the workload needs, which is its own discovery problem - Generation, not enforcement: nothing stops someone editing the result --- ### 5. Cartography **Best For:** Building a queryable graph of infrastructure assets and their relationships. **Overview** Cartography, originally from Lyft, consolidates infrastructure assets and the relationships between them into a Neo4j graph, spanning AWS, Azure, GCP, Okta, GitHub, Kubernetes, and more. It is not an opinionated security scanner: it gives you the graph and you write the queries. That makes it powerful for questions no scanner anticipated, such as which cloud roles are reachable from a GitHub repository through a CI integration. **Key Features** - Multi-cloud plus SaaS asset and relationship ingestion - Neo4j graph with Cypher query interface - Extensible ingestion modules - Cross-boundary questions spanning cloud, identity provider, and code - Community query library **License** Apache 2.0. **Pros** - Answers cross-domain questions nothing else can - Extensible to whatever systems you need in the graph - Excellent for asset and blast-radius investigation **Cons** - You operate Neo4j and write your own queries - Not a findings tool: no prioritization out of the box - Ingestion at scale takes tuning --- ### 6. ScoutSuite **Best For:** Multi-cloud security auditing with a browsable report. **Overview** ScoutSuite from NCC Group collects configuration data across AWS, Azure, GCP, Alibaba Cloud, and Oracle Cloud, then produces a browsable HTML report of security findings including a substantial IAM section. It is auditor-oriented: the report is designed to be worked through systematically rather than integrated into a pipeline. **Key Features** - Multi-cloud configuration collection and assessment - Browsable offline HTML report - IAM, network, storage, and logging findings - Rulesets customizable for organizational standards - Read-only collection **License** GPL-2.0. **Pros** - Genuinely multi-cloud, with consistent presentation across providers - Offline report suits assessment engagements - Customizable rulesets **Cons** - Point-in-time assessment rather than continuous monitoring - Findings are configuration-level, not effective-permission analysis - Less actively developed than Prowler --- ### 7. CloudQuery **Best For:** Getting cloud configuration into SQL so you can ask arbitrary questions. **Overview** CloudQuery syncs cloud and SaaS configuration into a database, typically PostgreSQL, so you can query infrastructure with SQL rather than API calls. For entitlement work that means writing queries such as "every role with a wildcard action that has been unused for 90 days" without building an integration first. It is infrastructure for analysis rather than an analysis product. **Key Features** - Syncs AWS, Azure, GCP, and many SaaS sources into SQL - Plugin architecture for sources and destinations - Incremental syncs suitable for scheduled runs - Policy packs for common checks - Works with existing BI and alerting tooling **License** Mozilla Public License 2.0 for the core, with some plugins under other terms. **Pros** - SQL is a much lower barrier than a graph query language for most teams - Composes with reporting and alerting you already run - Broad source coverage including identity providers **Cons** - You write the analysis, it provides the data - Database operation and sync scheduling are your responsibility - Licensing varies by plugin, so check what you use --- ## How to run an entitlement programme Tools find the problem; a sequence fixes it. 1. **Size it.** Run Prowler for breadth and Cloudsplaining for AWS IAM specifically. You now know how many identities hold dangerous permissions. 2. **Find the paths.** PMapper answers which principals can reach administrative access and how. Fix the shortest paths first; they usually collapse several findings at once. 3. **Start with non-human identities.** The bulk of findings are service principals with unused permissions, and they are the safest to trim because no human workflow breaks. See [service account](https://startwithidentity.com/glossary/service-account/) and [non-human identity](https://startwithidentity.com/glossary/nhi/). 4. **Use usage data as the argument.** "This role has not used these 40 actions in 90 days" is something an owner will accept. "This role is over-privileged" is not. 5. **Generate rather than edit.** policy_sentry makes writing a correct least-privilege policy faster than writing a wildcard, which is the only sustainable fix. 6. **Measure the trend.** Track the count of identities holding unused high-risk permissions over time. If it is not falling, you have reporting rather than a programme. The honest limit of open-source tooling here is continuity. These are point-in-time scans, and permissions drift back. That is where commercial [CIEM](https://startwithidentity.com/vendors/ciem/) earns its cost: continuous evaluation, remediation workflow with rollback, and [just-in-time access](https://startwithidentity.com/glossary/jit-access/) so the reducible remainder never becomes standing privilege. ## Related reading - [Top 5 cloud infrastructure entitlement management tools](https://startwithidentity.com/articles/top-5-cloud-infrastructure-entitlement-management/) - [What is CIEM](https://startwithidentity.com/guides/fundamentals/what-is-ciem/) and [least privilege](https://startwithidentity.com/glossary/least-privilege/) - [Least privilege access best practices](https://startwithidentity.com/articles/least-privilege-access-best-practices/) - [Best CIEM for multi-cloud](https://startwithidentity.com/rankings/best-ciem-for-multi-cloud/) ## The open-source identity landscape This is one of a series covering open-source tooling across every identity category: - [Open-source IAM solutions](https://startwithidentity.com/articles/top-10-open-source-iam-solutions/) - [Open-source CIAM platforms](https://startwithidentity.com/articles/top-8-open-source-ciam-platforms/) - [Open-source IGA tools](https://startwithidentity.com/articles/top-5-open-source-iga-tools/) - [Open-source PAM solutions](https://startwithidentity.com/articles/top-7-open-source-pam-solutions/) - [Open-source MFA and passwordless tools](https://startwithidentity.com/articles/top-6-open-source-mfa-passwordless-tools/) - [Open-source authorization tools](https://startwithidentity.com/articles/top-7-open-source-authorization-tools/) - [Open-source secrets management](https://startwithidentity.com/articles/top-6-open-source-secrets-management/) - [Open-source password managers](https://startwithidentity.com/articles/top-7-open-source-password-managers/) - [Open-source zero trust and ZTNA tools](https://startwithidentity.com/articles/top-7-open-source-zero-trust-tools/) - [Open-source machine and workload identity](https://startwithidentity.com/articles/top-6-open-source-machine-identity-tools/) - [Open-source PKI and certificate management](https://startwithidentity.com/articles/top-6-open-source-pki-certificate-management-tools/) - [Open-source directory services and LDAP servers](https://startwithidentity.com/articles/top-6-open-source-directory-services/) - [Open-source Active Directory security tools](https://startwithidentity.com/articles/top-7-open-source-active-directory-security-tools/) - [Open-source decentralized identity tools](https://startwithidentity.com/articles/top-7-open-source-decentralized-identity-tools/) - [Open-source secrets scanning and NHI tools](https://startwithidentity.com/articles/top-6-open-source-secrets-scanning-nhi-tools/)