Open Source Cloud Security
An enterprise-grade, agentless, and open-source cloud security platform for AWS, GCP, and Azure that combines CSPM, DSPM, CIEM, ASM, and vulnerability management with deterministic YAML policies and natural language querying.
A set of tutorials to learn how to automate various Prisma Cloud tasks.
Multi-cloud xSPM platform to scan, visualize, and remediate security risks across cloud, containers, and Kubernetes environments.
Security graph visualization for Cloudsmith repositories. Maps SCA (CVEs, transitive dependency risk, quarantine) and CIEM (members, teams, service accounts, entitlements) into interactive graphs, so DevOps and Security teams can trace blast radius and attack paths at a glance. Ships as a single Docker container. Not affiliated with Cloudsmith.
An MCP server to enumerate AWS IAM data, analyze effective permissions, and visualize access relationships across users, roles, and resources. Built for cloud security engineers who want fast, easy and effective insights into AWS identity risk
Air-gapped, deterministic AWS/Azure/GCP IAM privilege-escalation scanner — Terraform PR-gate, MCP for Cursor/Claude Code, offline licensing. Runs on your own metal.
Top Cloud Infrastructure Entitlement Management CIEM (Opensource) Star if you like it!
Entra identity lifecycle: build, operate, and govern. Hybrid sync, Graph PowerShell automation, and CIEM least-privilege
Top Cloud Infrastructure Entitlement Management (CIEM) (Opensource) 🌟 Star if you like it! 🌟
Sonrai Security — independent third-party profile of a public API surface, by API Evangelist. Sonrai Security is a cloud identity and access security company whose Cloud Permissions Firewall (CPF) enforces least-privilege access across AWS, Azure, and Google Cloud by quarantining unused IAM identities, protecting sensitive permissions, and disablin
🔍 Enhance cloud security visibility across AWS, GCP, and Azure with open-source tools for misconfiguration, data discovery, and vulnerability management.
Autonomous CIEM and IAM governance engine detecting privilege escalation risks, unused permissions, and cross-account trust flaws in AWS.
Predictive Multi-Cloud Identity Security & CI/CD Guard. Detect escalation paths, analyze dynamic privilege usage, and block risky IAM changes in the pipeline
Agentless GCP drift-detection canary — projects, VMs, firewall rules, buckets, service accounts, SA keys, IAM bindings, and AI-workload signals; every delta to Slack. Identity is the attack surface. Detection half of paved-org.
Open-source, self-hosted Azure & Microsoft Entra access governance with ISO 27001 / SOC 2 compliance evidence Policy & RBAC visibility, drift detection, and reviewed just-in-time access with auto-expiry. A lightweight alternative to Entra ID Governance, PIM, and per-seat GRC.
Security engineering platform focused on identity, configuration, and workload security, built on a staged on-prem foundation with Elastic telemetry and controlled Kubernetes and cloud integrations.
Ermetic — independent third-party profile of a public API surface, by API Evangelist. Ermetic is a cloud security company founded in 2019 that pioneered cloud infrastructure entitlement management (CIEM) as part of a unified, identity-first cloud-native application protection platform (CNAPP) spanning AWS, Azure, and GCP.
To associate your repository with the ciem topic, visit your repo's landing page and select "manage topics."