The views allow you to quickly assess access-related risks by highlighting areas that require your attention. Begin by identifying risk hotspots through blocks that display a high number of excessive permissions. Prioritize cleanup efforts by locating inactive, empty, or unused entities that could unnecessarily increase your attack surface. If deeper investigation is needed, expand any block to examine the specific identities, policies or roles involved. Additionally, track trends over time with numeric indicators, that help you monitor any increase or decrease in risk-prone entities. Together, these insights provide a clear starting point for determining where to focus your investigation or remediation efforts.  

With Saner CIEM, you can identify users in cloud IAM that have access to cloud resources but have not been active, which means the users have not logged in, used, or performed any actions for a considerably long period.  Additionally, the dashboard also presents users with excessive permissions that could result in privilege escalation and does not fit well with Principle of Least Privilege (PoLP) of Cloud Service Providers. 

You can also see if there has been an increase or decrease in Excessive Users as part of resource Trend. 

Clicking the numbers, text or icon on the block, navigates to the detailed contextual view providing a breakdown on the Users and their associated permissions.  

The User  Details view provides a consolidated snapshot of GCP User’s identity attributes and access relationships. It displays key metadata such as the User ID, Display Name, Created Date, Last Accessed Date, associated Policies, Permissions, and User Groups.  

The main feature of the page is the User Details Graph, which visually maps the user’s linked Organizations, Projects, Permissions, Groups, Roles, and Actions. This helps administrators easily understand hierarchical access paths and inherited permissions at a glance.  

The left panel lists all users and includes status icons that indicate their security state: the Hand icon represents Inactive users, the Red  colored icon highlights users with Excessive permissions, and the Green colored  icon identifies Active users.

Click the filter button next to the Search box to display the related Unused and Excessive users.  

Clicking on the names of Entra of RBAC roles nodes assigned to the user, redirects to the detail page of the clicked Role node. 

User can either choose to expand or collapse the full graph with “Expand All button”, or they can also choose to expand each node separately. The graph can also be viewed in Vertical as well as Horizontal view, just with a click of a button. Clicking any metadata item that contains a link (for example, Entra ID or User Groups) drills down further into another contextual view showing associated metadata such as user assignments, group details, or linked resources. 

Groups in cloud entitlements refer to collections of user accounts that facilitate management of access rights and permissions in cloud environments.   

With Saner CIEM, users can identify Groups which are empty because empty groups with excessive permissions become easy target for the attackers.  

The dashboard view also presents the count of groups having excessive permissions in the associated cloud service.  

Clicking the numbers, text, or icon on the block, navigates to the detailed contextual view providing a breakdown on the group and their associated permissions.  

The Group Details view provides a consolidated snapshot of Group’s attributes and access relationships. It displays key metadata such as the Group ID, Display Name, Group Email, Users present in the Group, associated Service Accounts, Allowed as well as High Privilege Allow Policies attached to the Group. 

Additionally, the Group Details Graph also provides a visual representation of the group’s associated roles, projects, and users, enabling administrators to quickly understand hierarchical access relationships and inherited permissions at a glance. It also highlights the policy document evidence that explains why the group is identified as having excessive permissions, helping administrators investigate and remediate access risks efficiently. 

The left panel lists all groups and includes status icons that indicate their security state: the Red colored  icon highlights groups with Excessive permissions, and the Green colored  icon identifies Active groups. Click the filter button next to the Search box to display the related Empty, Excessive groups.  

Clicking on the names of Policy or Roles nodes assigned to the Group, redirects to the detail page of clicked Policy or Role node. 

User can either choose to expand or collapse the full graph with “Expand All button”, or expand each node separately. The graph can also be viewed in Vertical as well as Horizontal view, just with a click of a button. 

Clicking any metadata item that contains a link drills down further into another contextual view showing associated metadata such as user “High Privilege Allow Policies” or “Allow Policies”.  

Service account in GCP is a non-human identity used by applications, workloads, or services to authenticate and access Google Cloud resources. Service accounts can be granted permissions using GCP Roles. 

Clicking the numbers, text or icon on the block, navigates to the detailed contextual view providing a breakdown on the Service Accounts and their associated permissions. 

The Service Account details view provides a comprehensive snapshot of a GCP Service Account’s identity and permission footprint. 

It displays key metadata such as the Service Account’s ID, Display Name, Email, Allowed and High Privileged allowed Policies. Clicking any metadata item that contains a link drills down further into another contextual view showing associated metadata mentioned above. 

The left panel lists all Service Accounts with associated IDs in brackets and includes status icons that indicate their security state: the Red colored icon highlights Service Account with Excessive permissions, and the Green icon identifies Service Account with no Excessive permission.  

At the centre, the Service Account Details Graph visually maps the Service Account’s elevated actions. This helps administrators easily understand hierarchical access paths and inherited permissions at a glance. Administrators can also see what is the “Evidence in Policy Document” that makes this Service Account excessive. 

You can either choose to expand or collapse the full graph with “Expand All button”, or expand each node separately. The graph can also be viewed in Vertical as well as Horizontal view, just with a click of a button. 

In GCP, an IAM policy is basically a set of rules that decides who can do what on which resources. Policies are generally attached to resources. Once attached, they control access to everything under that resource. 

Saner Cloud CIEM shows the Policies that carry Excessive Permissions and also Orphaned Bindings in Policies which means the IAM role binding that references a principal (user, group, or service account) that no longer exists. 

Clicking the numbers, text or icon on the block, navigates to the detailed contextual view providing a breakdown on the Service Accounts and their associated permissions.

It displays key metadata such as the Service Policy’s Name, Entities like Users, Groups and Service Accounts, Custom and Google Managed Roles, Policy Bindings and more. Clicking any metadata item that contains a link, drills down further into another contextual view showing associated metadata mentioned above. 

The left panel lists all Policies with associated IDs in brackets and includes status icons that indicate their security state: the Red icon highlights the Policy with Excessive permissions, and the Green colored icon identifies Policy with no Excessive permission.  

The Policy Details Graph visually maps the excessive roles that are bound to the Principals and helps administrators easily understand hierarchical access paths and inherited permissions at a glance. Administrators can also see what is the “Evidence in Policy Document” that makes this Policy excessive. 

User can either choose to expand or collapse the full graph with “Expand All button”, or expand each node separately. The graph can also be viewed in Vertical as well as Horizontal view, just with a click of a button. 

In Google Cloud Platform (GCP) Roles are collections of permissions that define what actions a principal can perform on GCP resources. Roles can be assigned to principals (users, groups, service accounts) through IAM policies. 

The total roles are collection of google roles which are attached to a principal and custom created role. CIEM also shows how many of these total roles have Excessive Permissions. Lastly, it displays Custom Created roles which are not attached to any IAM Entity.  

In the context of Saner CIEM dashboard, the Roles block provides a quick assessment of identity-level privilege risks. It highlights roles with excessive permissions, identifies unused or redundant roles, and supports the enforcement of least privilege principles. 

Clicking the numbers, text or icon on the block, navigates to the detailed contextual view providing a breakdown on the Entra Roles and their associated permissions.  

It displays key metadata such as the Custom and Google Managed Roles, Permissions that are allowed and denied, which Project it is associated with and Evidence in Policy Document. 

The left panel lists all Roles with associated IDs in brackets and includes status icons that indicate their security state: the Red colored  icon highlights the Policy with Excessive permissions, and the Green  colored icon identifies Policy with no Excessive permission.  

The Roles Details Graph visually maps the excessive roles that are bound to the Principals and helps administrators easily understand hierarchical access paths and inherited permissions at a glance. Administrators can also see what is the “Evidence in Policy Document” that makes this Role excessive. 

User can either choose to expand or collapse the full graph with “Expand All button”, or expand each node separately. The graph can also be viewed in Vertical as well as Horizontal view, just with a click of a button. 

The Google Managed Roles with Excessive Permissions view provides a concise overview of GCP Managed Roles that assigns permissions and helps security administrators to quickly identify potential areas of risk that need deeper investigation. 

Instead of just showing “who has what role”, this view shows how risky those roles are, so that one can prioritize which issues to fix first. For example, in this case, you must fix impersonation roles first, because they enable privilege escalation. 

Legacy Primitive Role 

These are old, broad roles that were used before more granular IAM roles became standard. They are risky as they assign wide permissions, not aligned with least privilege and applies across many services. 

Primitive Role 

This category shows basic predefined roles that grant access across almost all services in a project. They are risky as they are not service-specific, may include hundreds or thousands of permissions and are common source of excessive access 

Administrative Role 

Roles in this category are designed to manage specific services or infrastructure. These are flagged because they allow creation/modification/deletion of resources, may allow IAM policy changes and could enable infrastructure takeover.

Dangerous Role 

These are the roles that include permissions commonly used in Privilege escalation, Policy modification, and Security control bypass.

Impersonation Role 

These roles allow a user or service account to act as another service account and can also lead to Privilege escalation and Lateral movement. 

Clicking on any count in the block opens a detailed Information page for the selected role category. This page allows for further exploration through metadata links, allowing you to access deeper layers of related role and permission data. This helps administrators quickly identify Google Managed Roles assignments that may pose security risks due to elevated, privileged, or overly broad access.  

The Custom Roles in GCP are user-defined IAM roles that contain a custom set of permissions selected by your organization. They help you create your own role with only the exact permissions required. Saner Cloud CIEM categorises these custom roles so that you can prioritize which issues to fix first.

High Risk Permissions 

Roles under this category can directly lead to Privilege escalation, can modify IAM policy, can bypass Security control and lead to full project takeover. 

Administrative Permissions 

Permissions that allow managing, modifying, or deleting resources within a service. These permissions don’t necessarily escalate privileges, but they allow full control of services. 

Cross Project Access Permissions 

These are the permissions that allow a principal to access or modify resources across multiple projects. They are risky because they increase the blast radius in case of an attack and are harder to contain during incident response. 

Cross Organization Access Permissions 

These permissions allow access beyond your GCP organization boundary. It is hard to monitor external misuse, and they can increase supply-chain attack surface. 

Wildcard Permissions 

These are the permissions granted using wildcards (*) that allow broad actions. They are risky as they grant future permissions automatically, making it hard to audit exact scope and are often unintentionally over-privileged. 

Invalid or Deprecated Permissions 

Permission that either no longer exist, deprecated by Google, not valid in custom roles or tied to retired services that fall under this category.  

Clicking on any count in the block opens a detailed Information page for the selected role category. This page allows for further exploration through metadata links, allowing you to access deeper layers of related role and permission data. This helps administrators quickly identify Google Managed Roles assignments that may pose security risks due to elevated, privileged, or overly broad access.  

Ensure the following actions are logged and reviewed periodically: 

Restrict Permissions 

Use the principle of least privilege, granting access to these actions only to trusted, high-level users or service roles. 

Enable Multi-Factor Authentication (MFA) 

Require MFA for users with permissions to perform these actions. 

Use Resource Policies 

Set resource-based policies to add an extra layer of control. 

Tag Governance 

Maintain a tagging strategy and monitor un-tagging actions. 

Note that Saner Cloud only displays Activities that are flagged as “Risky” by GCP to keep you focused on the important events. 

Saner Cloud uses GCP API to fetch the events and display them in Critical Activities section on CIEM Dashboard categorised into scope-based sections.  

Each column provides specific insight, from identifying the event through its unique Event Name, Event Category, Who performed this activity, Resource ID, Service name, IP, timestamps, and the supporting evidence behind each alert, allowing effective monitoring, investigation, and response to potential identity-based threats.