CIEM
Cloud Infrastructure Entitlement Management. Tools that discover and right-size identities and permissions across AWS, Azure, and GCP, reducing excessive and unused entitlements. Focuses on effective permissions, the access an identity can actually use.
CIEM exists because cloud IAM policies are effectively unreadable at scale: permissions come from identity policies, resource policies, permission boundaries, service control policies, and role chains, and the effective answer is a computation rather than a lookup. The value is showing what an identity can actually do versus what it has used, which is what makes right-sizing possible. Most findings are unused permissions on service principals rather than over-privileged humans.
See also: what is CIEM, least privilege, entitlement, CIEM vendors
Related on Start with Identity
- GlossaryRole Mining
Analyzing existing access to discover sensible roles, reducing role explosion and cleaning up entitlements. A common step in rolling out or fixing RBAC. Role mi
- GlossaryAccess Certification
Periodic review of who has access to what, with managers or resource owners attesting that access is still appropriate. A regulatory requirement in many industr
- GlossaryIAM
IAM stands for Identity and Access Management. Workforce identity for employees, contractors, and partners. Covers authentication, authorization, lifecycle, and
- PodcastIdentity at the Center
The longest-running weekly show on identity and access management programs, hosted by two practitioners. The best single feed for keeping up with the field.
- PodcastKuppingerCole Analyst Chat
Weekly conversations between KuppingerCole analysts on identity architecture, governance, AI agents, and the market. Over 300 episodes since 2020.
- BlogMoving into IAM? Start with workforce identity and learn to trace one person's access
Most people who move into identity and access management land in workforce identity first: employees, contractors and the systems they sign in to. The fastest w