Cloud PAM and CIEM Guide

In the cloud, privilege is not a small set of admin accounts. It is thousands of IAM policies, roles, service principals and permissions spread across accounts, subscriptions and projects. Most human and machine identities in the cloud hold far more permission than they use, and a single over-permissive role can be the step from a foothold to full control. Cloud infrastructure entitlement management (CIEM) analyses and right-sizes these permissions; cloud PAM brings just-in-time and session controls to cloud access. This guide explains cloud privilege risk, how CIEM and cloud PAM work, and how to reduce cloud permissions safely.

Key takeaways

• Cloud privilege lives in policies and role assignments, many attached to non-human identities, so traditional vault-centred PAM covers only part of it.
• CIEM finds the gap between permissions granted and permissions used, maps effective access and identifies escalation paths.
• Cloud PAM replaces standing console and CLI admin access with just-in-time, time-bound, approved elevation.
• Right-size in stages using activity data, starting with unused high-risk permissions, and prevent regression with policy guardrails.

Why cloud privilege is hard

• Scale and granularity: each major cloud provider has thousands of individual permissions.
• Many identity types: users, groups, roles, service accounts, service principals, managed identities, federated identities and cross-account trusts.
• Inheritance and indirection: permissions come from organisation, folder, account and resource policies, roles that can be assumed, and resource-based policies.
• Escalation paths: permissions such as creating access keys for other users, passing roles to services, or editing IAM policies let an identity grant itself more privilege.
• Machine identities dominate: most cloud identities are workloads, often created by automation with broad default roles.

Incidents such as the large-scale extortion campaign against misconfigured cloud environments, TruffleNet and Storm-2949 show attackers turning cloud identities and credentials into broad access.

What CIEM does

• Inventory every identity and entitlement across cloud accounts.
• Compute effective permissions, resolving inherited and assumable access.
• Compare granted with used permissions over a look-back period.
• Identify risks: admin and wildcard permissions, escalation paths, external and cross-account trusts, dormant identities, long-lived keys.
• Recommend least-privilege policies based on actual use.

Cloud providers offer native access analysis features; dedicated CIEM tools add multi-cloud coverage and deeper analysis.

What cloud PAM does

• Makes humans eligible for privileged cloud roles rather than permanently assigned. See the JIT Access Guide.
• Issues short-lived console and CLI sessions after MFA and approval.
• Records who elevated, why and what they did.
• Controls access to cloud virtual machines, Kubernetes and databases through brokered, audited sessions.

Right-sizing safely

1. Collect activity data for long enough to capture periodic jobs (for example, 90 days).
2. Start with high-risk, unused permissions: admin, IAM modification and data deletion rights that are never used.
3. Remove dormant identities and keys.
4. Replace wildcards with specific actions and resources.
5. Stage changes: apply in non-production, monitor for access denied errors, then production.
6. Prevent regression: use organisation-level guardrail policies, infrastructure-as-code checks and approval for privileged policy changes.

Non-human identities in the cloud

• Use platform identities (roles, managed identities, attached service accounts) rather than keys. See the Cloud Workload Identity Guide.
• Give each workload its own identity and least-privilege policy.
• Restrict who can pass roles to services and who can create keys for service accounts.
• Pin federation and cross-account trust policies to specific principals and conditions.
• Review default service accounts and remove broad default roles.

Practitioner checklist

• Inventory cloud identities and entitlements across all accounts and providers.
• Identify admin, wildcard, escalation-capable and cross-account permissions.
• Right-size using granted-versus-used analysis, starting with high-risk unused permissions.
• Move human admin access to just-in-time elevation with MFA and approval.
• Replace workload keys with platform identities and tighten trust policies.
• Add guardrail policies and infrastructure-as-code checks to prevent regression.
• Monitor privileged cloud activity and IAM changes.

Standards and references

• OWASP Non-Human Identities Top 10 (2025): NHI5, NHI6, NHI7
• CSA Cloud Controls Matrix
• CIS Benchmarks for major cloud providers
• MITRE ATT&CK Cloud Matrix

Related NHI Mgmt Group resources: Cloud Workload Identity Guide · Privileged Access Management Guide · PAM Buyer's Guide · Kubernetes NHI Security Guide