Cloud Security
CIEM tools that shrink the unused role (2026)
A 2026 shortlist of cloud identity graphs. Public docs, not a privilege-escalation cookbook.
Expertise: Cloud Security · Level: Intermediate · 12 min read
Admin on a forgotten role is still admin.
CSPM told you the bucket was public. CIEM asks who can still assume the role that opened it. Link the CSPM list for account misconfig. This page is the identity graph.
Six graphs. Two AWS-native open tools. One AWS button. One SQL scanner. Two commercial platforms. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| PMapper | AWS principal graph you can build yourself | GPL-3.0 |
| Cloudsplaining | Lint AWS policies you already exported | BSD-3-Clause |
| IAM Access Analyzer | The AWS button for unused and external access | AWS terms |
| Steampipe | SQL on live cloud IAM you already can read | AGPL-3.0 |
| Wiz | Commercial graph next to a CSPM you already bought | Commercial |
| Prisma Cloud | Palo Alto CIEM on the platform you already named | Commercial |
PMapper
Best for aWS principal graph you can build yourself
Principal Mapper builds a graph of who can assume what in an AWS account you already own. The output is a path, not a slide.
Key features
- Who-can-access queries
- You run it with your creds
- Graph output
- GPL-3.0
Why we like it
This is the hidden gem. A path you can explain beats a CIEM heatmap you cannot.
Limits
AWS-shaped. You hold the keys. We will not publish a privilege recipe.
Cloudsplaining
Best for lint AWS policies you already exported
Cloudsplaining reviews IAM policy JSON for privilege issues they document. You point it at accounts you operate.
Key features
- Policy reports
- HTML out
- You bring the JSON
- BSD-3-Clause
Why we like it
When the hole is a wildcard in a customer-managed policy, a linter is enough.
Limits
Snapshot, not a live graph. AWS-shaped. Not Azure or GCP.
IAM Access Analyzer
Best for the AWS button for unused and external access
Access Analyzer finds external access and unused access they document. It lives in the account you already pay for.
Key features
- External access findings
- Unused access they document
- No extra agent
- AWS console and API
Why we like it
Turn it on before you buy a third graph. Honesty is a button you skipped.
Limits
AWS-only. Findings still need an owner. Not a multi-cloud CIEM.
Steampipe
Best for sQL on live cloud IAM you already can read
Steampipe is SQL over cloud APIs. IAM mods let you ask who still has admin. The CSPM list already rows it. Here it is the identity query.
Key features
- SQL on IAM tables
- Many cloud mods
- You run the CLI
- AGPL-3.0
Why we like it
A query you can keep in git is CIEM-as-code for a small team.
Limits
AGPL. You still write the query. Overlap with the CSPM page is declared.
Wiz
Best for commercial graph next to a CSPM you already bought
Wiz sells a security graph. CIEM is a view on the same graph as CSPM. Overlap with the CSPM list is declared.
Key features
- Identity paths they sell
- Same graph as CSPM
- Tickets
- Commercial
Why we like it
If the estate is already Wiz, do not buy a second CIEM logo.
Limits
Commercial. We did not run a tenant. This is not a second CSPM recap.
Prisma Cloud
Best for palo Alto CIEM on the platform you already named
Prisma Cloud includes IAM and entitlement views. If procurement already wrote Prisma, this is the shelf.
Key features
- Entitlement views they document
- Multi-cloud they sell
- Same Prisma tenant
- Commercial
Why we like it
Known neighbor so the open tools have a commercial pair.
Limits
Commercial. Platform gravity. We did not run it.
What the internet thinks about CIEM tools
IAM threads treat unused admin as the quiet hole. We keep that line. A graph is not a privilege-escalation lab.
Prove PMapper still publishes
Confirm PMapper still publishes. Run it only with credentials for an account you operate.
git ls-remote --heads https://github.com/nccgroup/PMapper.gitFAQs
Does CIEM replace CSPM?
No. CSPM reads the account config. CIEM asks who can still assume the role. Link both.
Is Access Analyzer enough?
It is the first button. Multi-cloud and custom graphs still need another row.
Will you publish assume-role recipes?
No. This page names collectors. It does not replay privilege paths.
Is this a scored bake-off?
No. Order is editorial.
