Cloud infrastructure entitlement management (CIEM) is software that checks every human and machine identity in a company's cloud accounts, on platforms such as Amazon Web Services (AWS), Microsoft Azure and Google Cloud, and finds permissions that are wider than the identity needs. An entitlement is a permission: the right to do one action, such as reading files, on one resource, such as a storage bucket. A storage bucket is a named folder in cloud storage.
Cloud platforms have their own permission systems, with thousands of possible actions. A developer who sets up a new program often gives it a broad permission, such as full access to storage, because working out the exact actions takes time. The program works, and nobody comes back to narrow the permission. After a few years, a company may have thousands of such identities. Most of them are non-human identities: roles that programs, servers and automated jobs use.
Who is responsible for these permissions? Under the shared responsibility model, the cloud provider secures its data centres and its platform. The customer is responsible for who gets which permission. So an over-broad permission is the customer's risk. If an attacker steals the key of a program that has full access to storage, the attacker gets full access too.
CIEM does two things. First, it reads every identity, role and policy in every cloud account, and works out the effective permission of each identity: everything it can actually do, after all its policies are combined. Second, it reads the cloud's activity logs, to see which permissions each identity has really used. The difference between the two is unused permission, which can usually be removed safely.
Say an online ticketing company in Pune runs its booking system on AWS, in the Mumbai region. CIEM finds the program that generates e-tickets. Its role allows it to read, write and delete in all 40 storage buckets in the account. In the last 90 days, it has only read from one bucket of ticket templates and written to one bucket of issued tickets. CIEM writes a new policy that allows only those two actions on those two buckets, and the cloud team applies it. The program works as before. A stolen key for it would now reach two buckets instead of 40, and it could not delete anything.
CIEM is close to cloud security posture management (CSPM). CSPM checks cloud settings, such as a storage bucket that is open to the whole internet. CIEM checks permissions. CIEM also sends its findings to identity security posture management (ISPM), which maps permissions across all of a company's systems, not only the cloud. In this way, CIEM applies least privilege inside the cloud.