The process starts with collecting data through the IAM inventory fetching, which is handled by the core ingestion pipeline. Cloud Connectors authenticate with your AWS and Azure accounts to gather IAM-related metadata. This metadata includes user and role permissions, group memberships, trust policies, and both attached and inline policies. Once the data is collected, it is normalized and stored in the internal Identity store, serving as the foundation for identifying accounts with excessive authorizations.

The Entitlement Scanner, which is part of the CIEM module, identifies privilege misconfigurations by applying both static and contextual rules. For example, it checks to ensure that IAM users do not have full access to all services. The rule engine evaluates various conditions, such as overly permissive access (like using wildcards or having admin-level policies), unused or dormant identities, cross-account access without proper constraints, and violations of the principle of least privilege. Any misconfigurations that are identified, are flagged and assigned severity ratings to help prioritize them.

The CIEM UI layer visually highlights overprivileged identities by querying the Identity Store for potential misconfigurations. The frontend presents this information through interactive dashboards, which display affected users, roles, or groups, the severity level of each risk, and the specific rules that have been violated, along with contextual risk details. This approach allows security teams to quickly identify and assess high-risk identity configurations.

When a user initiates a remediation action by clicking “Remediate,” the request is directed to the Cloud Security Remediation Management (CSRM) module. At this point, the system gathers relevant metadata about the misconfiguration along with predefined remediation templates, such as policy pruning or user disablement. It may also prompt the user for any necessary inputs or confirmations, such as selecting an updated IAM policy, to ensure that the remediation is executed accurately and securely.

Example flow of an Overprivileged IAM User

In this example flow, an IAM user has been identified with “AdministratorAccess” permissions but is not part of the designated admin group. CIEM recognizes this as a critical issue and flags it with high severity. When the user initiates the remediation process by clicking “Remediate,” the system provides options to detach the overly permissive policy and replace it with a more restrictive policy. This can be based on actual usage patterns or predefined templates. The CSRM module then carries out the selected remediation. In the subsequent scan, the system confirms that the user’s permissions have been successfully adjusted to ensure least-privilege access.

The CSRM Function Engine manages the execution of remediation actions to address identity risks. Once a remediation function is selected, it is executed using cloud-native APIs like AWS IAM or Azure AD Graph. The actions carried out may include detaching risky policies, removing unused permissions, converting users to roles for improved access control, or disabling and rotating access keys to enhance security.

After remediation, the Scanner conducts a follow-up scan to verify that the risky permission has been removed from the identity. Once this is confirmed, the issue status is updated to “Resolved.” The user interface (UI) is then refreshed to reflect the new status and display the corrected, healthy configuration, providing clear visibility into the successful remediation.

Helps you monitor dormant user accounts, which can be a security risk even without excessive permissions.

Inactive users in cloud entitlements refer to accounts or user identities that have access to cloud resources but have not been active, meaning they have not logged in, used, or performed any actions for a considerably long period. This inactivity can pose potential risks to the security and efficiency of your cloud environment. With Saner CIEM, users can identify inactive accounts on specific cloud platforms(AWS or Azure).
 
The dashboard view presents the count of users who have not been active and pose a security risk(for example, credential, compromise, unmonitored access attempts, and more). Additionally, the dashboard also presents unused or excessive permissions that result in privilege escalation or account compromise issues.
 
Clicking the link(arrow) navigates to the detailed contextual view providing a breakdown on the user and their associated permissions.

The User Details view provides a consolidated snapshot of an Azure user’s identity attributes and access relationships. It displays key metadata such as the User ID, Display Name, Created Date, Last Accessed Date, associated Entra Roles, RBAC Roles, and User Groups.

The main feature of the page is the User Details Graph, which visually maps the user’s linked groups, roles, and privileges. This helps administrators easily understand hierarchical access paths and inherited permissions at a glance.

The left panel lists all users and includes status icons that indicate their security state: the Hand icon represents Inactive users, the Red icon highlights users with Excessive permissions, and the Green icon identifies Active users. Click the filter button next to the Search box to display the related Unused, Excessive users.

Overall, this view helps security teams assess an individual user’s access footprint and identify potential risks efficiently.

Clicking any metadata item that contains a link(for example, Entra ID or User Groups) drills down further into another contextual view showing associated metadata such as user assignments, group details, or linked resources.

Groups in cloud entitlements refer to collections of user accounts that facilitate management of access rights and permissions in cloud environments. Saner CIEM allows for managing permissions through these Groups, which helps streamline role assignments, reduce errors, and enhance scalability.
 
The dashboard view presents the count of groups having excessive permissions in the associated cloud service.
 
Clicking the link(arrow) navigates to the detailed contextual view providing a breakdown on the group and their associated permissions.

The Group Details view provides a consolidated snapshot of an Azure user’s identity attributes and access relationships. It displays key metadata such as the Group ID, Display Name, Description, Created Date, associated Entra Policies, Entra Roles, RBAC Roles, and High Privilege Roles.

The main feature of the page is the Group Details Graph, which visually maps the group’s linked users, roles, and policies. This helps administrators easily understand hierarchical access paths and inherited permissions at a glance.

The left panel lists all groups and includes status icons that indicate their security state: the Hand icon represents Inactive groups, the Red icon highlights groups with Excessive permissions, and the Green icon identifies Active groups. Click the filter button next to the Search box to display the related Unused, Excessive groups.

Overall, this view helps security teams assess a group’s access footprint and identify potential risks efficiently.

Clicking any metadata item that contains a link (for example, User List) drills down further into another contextual view showing associated metadata such as user assignments, group details, or linked resources.

A policy establishes the rules and permissions that govern access to resources in a cloud environment. These policies are crucial for managing security, ensuring compliance, and enforcing governance within cloud infrastructure. Saner CIEM enables the management of policies that are presented in JSON format. These documents specify the actions, resources, and conditions under which permissions are granted or denied.

Clicking the link(arrow) navigates the user to the detailed view providing a providing a concise visualization of what’s described in each policy:

1) Policy Information that include:  Name, ID, ARN, Created Date, Roles, Users and Groups, Policy Type, and Evidence for Excessive Permission
2) Policy Details that include: Services, Resources, and Effect(allow or deny access to policies)
3) Policy Details Graph that shows a visual representation of the role connected with the policy

Roles in cloud entitlements outline a specific set of permissions that determine the actions a user, group, or service can perform on resources within the cloud environment. In Saner CIEM, roles are a fundamental part of identity and access management (IAM) systems. They are designed to enforce the principle of least privilege, ensuring that identities have access only to what they need to perform their tasks.
 
The dashboard block displays the number of inactive IAM (Identity Access Management) roles in your AWS account that may increase over time, making them unused or obsolete. If a role remains inactive for an extended period, it can create unnecessary access points, which could lead to authentication-based attacks.

Clicking the link(arrow) navigates to the detailed view providing a breakdown on the role and their associated permissions. Key details include:
1) Role overview with Name, ID, ARN, Created Date, Last Accessed Date, and policies that may allow high-privilege actions, etc.
2) Visual representation of the association between the role and its policies, making it easier to understand the intricate relationships between them

From the dashboard, go straight to the dashboard block Policies with Excessive Permission Based on Category and view the policy categories that Saner CIEM has automatically identified and listed as Excessive for your immediate use.

After you login, select Cloud Security from the landing page. Next, click the App Launcher(on top of the page) and choose CIEM(Cloud Infrastructure Entitlement Management).

Click any block as needed from CIEM dashboard and navigate to the details page. On the left-hand side of the page, use the filters to narrow down your search.

Click the Filter button on the side pane and combine filters to narrow down your results.

Filtering Options Available for the Different Identities:

After you login, select Cloud Security from the landing page. Next, click the App Launcher(on top of the page) and choose CIEM(Cloud Infrastructure Entitlement Management).

1. From the CIEM dashboard, click the “Policies” block to open the detailed statistics page
2. From the left-hand-side, filter by Permission Categories(Excessive). This lists all the policies that have excessive permissions.
3. Click the Evidence for Excessive Permission icon and analyze the information from the pop-up

1. Look at the “Reference Path” to understand where in the policy structure the excessive permission is defined
2. Review the “Response” to identify the action that may be unnecessarily allowed or denied

After you login, select Cloud Security from the landing page. Next, click the App Launcher(on top of the page) and choose CIEM(Cloud Infrastructure Entitlement Management).

From the CIEM dashboard, click on any of the Identity blocks(user/role/group/policy) to open the additional details page.

By identifying overly permissive roles, unused accounts, and insecure policies, Saner CIEM helps organizations proactively reduce their cloud attack surface. It supports revoking unnecessary permissions, bulk removal of unused entitlements through remediation actions, or enforcing security best practices.

From the Recommended Remediation block on the dashboard, click the icon (displayed as a wrench).

• Predefined: Displays all fixes that use default values. Choose the relevant fixes and proceed with remediation.
• Custom: Shows user-defined fixes, allowing you to modify the fixes before applying them.
• All: Displays a combination of both predefined and custom fixes. You can select from the entire range of fixes available and proceed with remediation.

Clicking the fix icon automatically redirects you to CSRM with the CIEM module opened, allowing you to directly create the patching task using guided remediation.

Go through the guided remediation for selecting and applying the necessary patches.

Click here for a detailed list of critical events with description and security implication.

Click here to read more about which actions are considered high-privilege in Critical Activity Logs in AWS and more.

After you login, select Cloud Security from the landing page. Next, click the App Launcher(on top of the page) and choose CIEM(Cloud Infrastructure Entitlement Management).

A quick look at what the columns represent:

Click the icon under the Evidence column in the Critical Activities block to view the evidence information.

Under the “Resources” column, just go ahead and click on the count to see the resources and types.

Users have an additional capability to filter critical activity logs with specific search criteria. From the search box within the Critical Activities block, key in your search criteria to retrieve the relevant information. Analyze the information for troubleshooting or subsequent action.

Users have an additional capability to filter critical activity logs with specific search criteria. From the search box within the Critical Activities block, key in your search criteria to retrieve the relevant information. Analyze the information for troubleshooting or subsequent action.

Excessive permissions can lead to unauthorized access, data breaches, or misuse of resources, so identifying them is critical. Saner CIEM helps identify excessive permissions and ensures your resources are only accessible by those who need them, reducing security risks.

After you login, select Cloud Security from the landing page. Next, click the App Launcher(on top of the page) and choose CIEM(Cloud Infrastructure Entitlement Management).

From the CIEM dashboard, click the Policies block and navigate to the Details page that displays the specific version(Active Version) of an IAM policy that is currently in effect for the user, group, or role to which the policy is attached.

By default, the first version of a policy is the active version when the policy is created. Subsequent versions are inactive until explicitly set as active from the appropriate cloud provider.