Start with Identity
Subscribe
Tools

Top 7 Open-Source Cloud Entitlement and CIEM Tools

The best open-source cloud IAM and entitlement tools in 2026, from Prowler and Cloudsplaining to PMapper, policy_sentry, Cartography, ScoutSuite, and CloudQuery, with what each finds across AWS, Azure, and GCP.

By SWI Community TeamUpdated 2026-08-2914 min read
Key takeaways
  • Cloud permissions are a computation rather than a lookup: effective access depends on identity policies, resource policies, permission boundaries, service control policies, and role chaining, which is why open-source analysis tooling exists at all.
  • The leading open-source options are Prowler, Cloudsplaining, PMapper, policy_sentry, Cartography, ScoutSuite, and CloudQuery.
  • These tools find and prove the problem; commercial CIEM adds continuous monitoring, remediation workflow, and just-in-time access. Start open source to size the problem before deciding whether you need to buy.

Ask a competent engineer what a specific service principal can actually do across your cloud accounts, and without tooling they cannot tell you. That is not incompetence: in AWS alone the effective answer depends on identity policies, resource policies, permission boundaries, service control policies, session policies, and role chaining, and it is a computation rather than a lookup. Cloud infrastructure entitlement management exists because of that gap.

The open-source ecosystem here is strong on discovery and analysis, which is the expensive part to build and the cheapest part to buy incorrectly. Running these tools first tells you how large your problem actually is, which is a much better basis for a commercial CIEM decision than a vendor demo. For the commercial landscape see the CIEM vendor category and Wiz vs Sonrai Security.

Evaluation Criteria

We assessed each tool against the following dimensions:

  • Cloud coverage, AWS only versus multi-cloud
  • What it finds, misconfiguration, over-permission, or escalation paths
  • Analysis depth, policy parsing versus graph traversal
  • Output usability, prioritized findings versus raw data
  • Automation, CI integration and scheduled scanning
  • Remediation support, whether it helps generate the fix
  • Maintenance, project health and update cadence

The Top 7 Open-Source Cloud Entitlement Tools

1. Prowler

Best For: Broad multi-cloud security assessment with a large check library, including IAM.

Overview

Prowler is the most widely used open-source cloud security assessment tool, covering AWS, Azure, GCP, and Kubernetes with hundreds of checks mapped to CIS benchmarks and other frameworks. Identity and access checks are a substantial part of that library: unused credentials, missing MFA on privileged accounts, over-permissive policies, and root account hygiene. It is the reasonable starting point because it gives you breadth quickly.

Key Features

  • Multi-cloud: AWS, Azure, GCP, and Kubernetes
  • Hundreds of checks mapped to CIS and other compliance frameworks
  • Multiple output formats for pipelines and dashboards
  • Continuous scanning support and CI integration
  • Active development with a commercial hosted option

License Apache 2.0.

Pros

  • Breadth of coverage across clouds and check types
  • Compliance framework mapping makes the output immediately useful to auditors
  • Large, active community

Cons

  • Breadth over depth: not a dedicated entitlement analysis engine
  • Large output requires triage discipline
  • Does not compute escalation paths the way graph tools do

2. Cloudsplaining

Best For: Finding AWS IAM policies that violate least privilege, with a readable report.

Overview

Cloudsplaining from Salesforce parses AWS IAM policies and identifies least-privilege violations, flagging policies that grant resource exposure, privilege escalation potential, credentials exposure, or data exfiltration capability. It produces a risk-prioritized HTML report rather than a raw list, which makes it unusually good at turning analysis into a work queue people will act on.

Key Features

  • AWS IAM policy parsing with least-privilege violation detection
  • Risk categories: resource exposure, privilege escalation, credential exposure, data exfiltration
  • Prioritized HTML report designed to be shared
  • Exclusions file for accepted risks
  • Offline analysis of downloaded policy documents

License Apache 2.0.

Pros

  • Output is genuinely readable and prioritized, which drives remediation
  • Offline analysis means no live account access required
  • Focused specifically on the least-privilege question

Cons

  • AWS only
  • Policy-level analysis, so it does not resolve full effective permissions across role chains
  • Needs an exclusions strategy or repeat findings become noise

3. PMapper

Best For: Finding actual privilege escalation paths in an AWS account.

Overview

PMapper (Principal Mapper) builds a graph of IAM principals and the edges between them, analyzing trust policies, resource-based policies, and the specific API calls that enable escalation, then answers questions such as which principals can reach administrative access and by what route. In comparative testing it has shown the highest privilege escalation detection rate among the common open-source options.

Key Features

  • Graph model of principals and escalation edges
  • Query interface for "who can reach what" questions
  • Analyzes trust policies and resource-based policies, not just identity policies
  • Visualization of escalation paths
  • Simulates authorization decisions

License Open source (AGPL-3.0).

Pros

  • Computes real escalation paths rather than flagging risky-looking policies
  • Query model answers the questions security teams actually ask
  • Strongest detection rate in comparative evaluations

Cons

  • AWS only
  • Command-line and query oriented, with no polished report
  • Graph construction takes time on large accounts

4. policy_sentry

Best For: Generating least-privilege IAM policies instead of hand-writing wildcards.

Overview

policy_sentry inverts the usual workflow: rather than auditing a bad policy after the fact, you declare the resources and access levels a workload needs and it generates a least-privilege IAM policy with correct actions and resource ARNs. It exists because writing least-privilege policies by hand is tedious enough that engineers reach for wildcards, and wildcards are the finding every audit produces.

Key Features

  • Generates IAM policies from a declarative YAML template
  • Access-level abstraction (read, write, list, tagging, permissions management)
  • Resource ARN construction from a simple specification
  • Query interface for the AWS IAM action database
  • CI-friendly for policy generation in pipelines

License MIT.

Pros

  • Attacks the root cause rather than the symptom
  • Makes least privilege the path of least resistance for engineers
  • Useful as a reference for what actions exist and what they do

Cons

  • AWS only
  • Requires knowing what access the workload needs, which is its own discovery problem
  • Generation, not enforcement: nothing stops someone editing the result

5. Cartography

Best For: Building a queryable graph of infrastructure assets and their relationships.

Overview

Cartography, originally from Lyft, consolidates infrastructure assets and the relationships between them into a Neo4j graph, spanning AWS, Azure, GCP, Okta, GitHub, Kubernetes, and more. It is not an opinionated security scanner: it gives you the graph and you write the queries. That makes it powerful for questions no scanner anticipated, such as which cloud roles are reachable from a GitHub repository through a CI integration.

Key Features

  • Multi-cloud plus SaaS asset and relationship ingestion
  • Neo4j graph with Cypher query interface
  • Extensible ingestion modules
  • Cross-boundary questions spanning cloud, identity provider, and code
  • Community query library

License Apache 2.0.

Pros

  • Answers cross-domain questions nothing else can
  • Extensible to whatever systems you need in the graph
  • Excellent for asset and blast-radius investigation

Cons

  • You operate Neo4j and write your own queries
  • Not a findings tool: no prioritization out of the box
  • Ingestion at scale takes tuning

6. ScoutSuite

Best For: Multi-cloud security auditing with a browsable report.

Overview

ScoutSuite from NCC Group collects configuration data across AWS, Azure, GCP, Alibaba Cloud, and Oracle Cloud, then produces a browsable HTML report of security findings including a substantial IAM section. It is auditor-oriented: the report is designed to be worked through systematically rather than integrated into a pipeline.

Key Features

  • Multi-cloud configuration collection and assessment
  • Browsable offline HTML report
  • IAM, network, storage, and logging findings
  • Rulesets customizable for organizational standards
  • Read-only collection

License GPL-2.0.

Pros

  • Genuinely multi-cloud, with consistent presentation across providers
  • Offline report suits assessment engagements
  • Customizable rulesets

Cons

  • Point-in-time assessment rather than continuous monitoring
  • Findings are configuration-level, not effective-permission analysis
  • Less actively developed than Prowler

7. CloudQuery

Best For: Getting cloud configuration into SQL so you can ask arbitrary questions.

Overview

CloudQuery syncs cloud and SaaS configuration into a database, typically PostgreSQL, so you can query infrastructure with SQL rather than API calls. For entitlement work that means writing queries such as "every role with a wildcard action that has been unused for 90 days" without building an integration first. It is infrastructure for analysis rather than an analysis product.

Key Features

  • Syncs AWS, Azure, GCP, and many SaaS sources into SQL
  • Plugin architecture for sources and destinations
  • Incremental syncs suitable for scheduled runs
  • Policy packs for common checks
  • Works with existing BI and alerting tooling

License Mozilla Public License 2.0 for the core, with some plugins under other terms.

Pros

  • SQL is a much lower barrier than a graph query language for most teams
  • Composes with reporting and alerting you already run
  • Broad source coverage including identity providers

Cons

  • You write the analysis, it provides the data
  • Database operation and sync scheduling are your responsibility
  • Licensing varies by plugin, so check what you use

How to run an entitlement programme

Tools find the problem; a sequence fixes it.

  1. Size it. Run Prowler for breadth and Cloudsplaining for AWS IAM specifically. You now know how many identities hold dangerous permissions.
  2. Find the paths. PMapper answers which principals can reach administrative access and how. Fix the shortest paths first; they usually collapse several findings at once.
  3. Start with non-human identities. The bulk of findings are service principals with unused permissions, and they are the safest to trim because no human workflow breaks. See service account and non-human identity.
  4. Use usage data as the argument. "This role has not used these 40 actions in 90 days" is something an owner will accept. "This role is over-privileged" is not.
  5. Generate rather than edit. policy_sentry makes writing a correct least-privilege policy faster than writing a wildcard, which is the only sustainable fix.
  6. Measure the trend. Track the count of identities holding unused high-risk permissions over time. If it is not falling, you have reporting rather than a programme.

The honest limit of open-source tooling here is continuity. These are point-in-time scans, and permissions drift back. That is where commercial CIEM earns its cost: continuous evaluation, remediation workflow with rollback, and just-in-time access so the reducible remainder never becomes standing privilege.

The open-source identity landscape

This is one of a series covering open-source tooling across every identity category:

Frequently asked questions

What are the best open-source CIEM tools in 2026?
The leading open-source cloud entitlement tools are Prowler for broad multi-cloud assessment, Cloudsplaining for AWS IAM least-privilege violations, PMapper for privilege escalation path analysis, policy_sentry for generating least-privilege policies, Cartography and CloudQuery for building a queryable asset and relationship graph, and ScoutSuite for multi-cloud auditing.
Can open-source tools replace commercial CIEM?
For discovery and assessment, largely yes: PMapper and Cloudsplaining find escalation paths and over-permissioned identities effectively. What commercial CIEM adds is continuous monitoring rather than point-in-time scans, remediation workflow with rollback, just-in-time access, and the reporting that makes right-sizing a programme rather than a project. Running the open-source tools first tells you how big the problem is.
What is the most common CIEM finding?
Unused permissions on non-human identities. The instinct is to look for over-privileged administrators, but the bulk of findings are service principals created for a project that ended, roles with wildcard actions granted under deadline pressure, and CI identities with permissions far beyond the single deploy they perform. Those are also the safest to remove.
How do you avoid breaking production when removing permissions?
Use usage data as the evidence and remove in stages. Access Analyzer in AWS and equivalent services elsewhere report which actions an identity actually used; policy_sentry can generate a least-privilege policy from a required action list. Remove unused permissions from non-human identities first, keep a documented rollback, and expand scope once the process has proven safe.
Do these tools cover Azure and GCP?
Coverage is uneven and AWS-centric. Prowler, ScoutSuite, CloudQuery, and Cartography span multiple clouds; Cloudsplaining, PMapper, and policy_sentry are AWS-specific because AWS IAM's policy evaluation model is what they were built to reason about. For Azure and GCP the graph-based tools plus native tooling are the practical combination.
Last reviewed By SWI Community TeamSuggest a correctionHow we research

Related on Start with Identity

Independent editorial review, no sponsorship. See more in our articles and rankings.