New Savings Proposals: approve, test and roll back cost changesLearn more Sign in|Talk to a cloud engineer
Product tourGet a demo

See who can reach what

CloudLens maps your identities and roles inside attack paths and works out their effective access to sensitive data — the policies, trust relationships and role chains behind a single High finding. Broad entitlement right-sizing is expanding in early access.

Talk to the teamSee attack paths
What you're watching — one finding, start to fixlive product
  1. 1
    The real findings list

    Every open finding in one list — severity, service, where it sits and SLA. This is the product, not a redrawn mock.

  2. 2
    Open the effective access

    Click a finding and the panel shows the identity, what it can assume, and the data it ends up reaching — effective access, not just the policy.

  3. 3
    See the access path

    The path from the scan’s network graph shows how an attacker actually reaches the data — internet, workload, role, store.

  4. 4
    File and mirror

    One click raises a Jira issue with the evidence attached, mirrored to Slack and Teams so the owner is paged.

Who does thisSecurity engineer, with the identity / platform teamWhat you getOver-privileged identities that actually reach data, each with the chain and an owner.
Effective
access
policies + trust + role chains, resolved
Identity
→ data
who can reach PII, PCI and secrets
In
attack paths
entitlement shown where it becomes risk
Early
access
broad right-sizing is expanding — talk to us

A policy document never tells you what it reaches

Permissions are written per identity, but risk is about what an identity can actually get to.

Reach

Raw policies hide the real access

What usually happens: Reading a role's JSON tells you the actions, not that iam:PassRole plus a trust relationship lets it reach a PII bucket two hops away.

How CloudLens resolves it: Effective access is resolved end to end, so the finding shows the actual chain from the identity to the data.

Resolved
Context

An over-permissioned role is worse when it is exposed

What usually happens: Identity tools and exposure tools live apart, so an admin-equivalent role on an internet-reachable workload looks like two separate mediums.

How CloudLens resolves it: Entitlement is shown inside the attack path, so the permission and the exposure are ranked as one combination.

Resolved
Fix

Least privilege stalls without a target

What usually happens: “Tighten this role” is hard when nobody knows which permission actually matters.

How CloudLens resolves it: The fix names the exact permission to remove and the one bucket to scope to, then re-checks the path.

Resolved

From an identity to the data it reaches

Open a finding and CloudLens resolves the full permission chain, with a least-privilege fix.

Effective access, resolved and ranked

See the full attack path
CloudLens reads IAM roles, policies and trust relationships read-only, resolves the effective access each identity has, and shows it where it becomes risk — inside the attack path to sensitive data.
  • Policies, trust and AssumeRole resolved
  • Identity to data, with the chain shown
  • Least-privilege fix, then re-checked
Early access

Help shape entitlement right-sizing in CloudLens

Talk to the team

How an over-permissioned role lost its path to PII

A Thursday at Lumora Retail: effective-access analysis shows a service role that can reach the customer-exports bucket.

NKNoah KimIAM engineer, Lumora Retail

Lumora Retail is a fictional company. The people, names and numbers are sample data.

    1
    Thu 11:10High

    A High effective-access finding lands

    role/checkout-api has iam:PassRole and s3:*, and the resolved chain reaches customer-exports (PII).
    2
    Thu 11:16

    Reads the chain, not the JSON

    The finding shows role/checkout-api → iam:PassRole → role/data-export → s3:GetObject → customer-exports.
    3
    Thu 11:28

    Applies least privilege

    iam:PassRole and the s3:* wildcard are removed; reads are scoped to the single bucket the service needs.
    4
    Thu 11:40SEC-158

    Re-checks the path

    Effective access no longer reaches PII, and a Jira issue SEC-158 records the change for audit.

Honest about what ships now

Available now

Identities and roles are mapped inside attack paths, with effective access to sensitive data and a least-privilege fix on each finding.

Read-only

IAM roles, policies and trust relationships are read through the same read-only connection as the rest of CloudLens.

Early access

Unused-permission right-sizing across every identity, and cross-cloud entitlement analytics, are expanding. Tell us what you need.

Attack Paths Internet → workload → role → data, ranked.
Cloud Security Posture Management Misconfigurations across every account.
Cloud Security One graph across cloud, identity and data.

CIEM questions

It maps identities and roles inside attack paths and resolves their effective access to sensitive data — the policies, trust relationships and role chains behind a finding — with a least-privilege fix. Broad entitlement right-sizing across every identity is in early access.

No. Roles, policies and trust relationships are read through the same read-only connection as the rest of CloudLens. Any change you make is applied by your team, not by CloudLens.

CSPM finds misconfigured resources. CIEM answers who can reach what: the effective permissions that let an identity get to sensitive data, shown where that access becomes real risk in an attack path.

Yes. The effective-access analysis shown here is available now. The broader entitlement right-sizing is expanding, and we would rather build it with your use case — talk to the team.

Ready to see CloudLens in action?

Connect a read-only AWS role or Azure service principal. We'll walk you through your bill, your security graph and the first things worth fixing.