Security Command Center 的 CIEM 功能可全面掌握身分和存取權設定的安全性。具體來說，下列 CIEM 功能可協助您找出錯誤設定，並強制執行最低權限原則：
偵測多個雲端平台 (包括 Google Cloud、Amazon Web Services (AWS) 和 Microsoft Azure (搶先版)) 部署作業中，可能出現的身分和存取權設定錯誤。
識別安全漏洞調查結果，深入瞭解在 Google Cloud、AWS 和 Microsoft Azure (搶先版) 環境中，授予主體的角色。這包括來自其他身分識別提供者的連結身分識別，例如 Entra ID (Azure AD)、Okta 和內部部署 Active Directory，適用於 Google Cloud
和 AWS IAM Identity Center。
提供如何修正設定錯誤的指引，例如從權限過高的主體移除權限。
案件管理功能可讓您使用 Security Command Center Enterprise 中的案件或其他支援單管理系統，有效追蹤錯誤設定的修正工作。
使用 CIEM 管理身分與存取權安全問題
以下各節說明 CIEM 功能，可協助您管理身分和存取權設定錯誤。
快速存取身分與存取權發現項目
如果身分和存取權設定錯誤 (例如高權限主體、閒置身分、未輪替的服務帳戶金鑰，以及缺少多重驗證)，往往會導致安全問題。CIEM 會產生調查結果，協助您在雲端環境中找出潛在的身分和存取權安全問題。許多不同的 Security Command Center 偵測服務 (例如 IAM 建議、安全狀態分析和 CIEM) 會產生身分識別和存取權發現項目，這些項目視為 Security Command Center CIEM 功能的一部分。舉例來說，CIEM 偵測服務本身會產生 AWS 和 Microsoft Azure 的身分與存取權發現項目子集 (搶先版)，提醒您高權限角色、群組和使用者。
透過 CIEM，Security Command Center 會在 Security Command Center 風險總覽頁面的「身分和存取權發現項目」資訊卡上，依類別顯示 Google Cloud、AWS 和 Microsoft Azure (預先發布版) 的身分和存取權發現項目。 Google Cloud這張資訊卡可讓您快速存取 Security Command Center「發現項目」頁面，查看經過篩選的身分與存取權設定錯誤發現項目。詳細查看時，每項發現都會提供偵測到的完整範圍，以及如何解決設定錯誤的指引，避免潛在的攻擊向量。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers) (not available if [data residency controls](docs/data-residency-support) are enabled)\n\nWith Security Command Center's Cloud Infrastructure Entitlement Management (CIEM) capabilities, you can\nmanage which identities have access to which resources in your deployments on\nmultiple cloud platforms and mitigate potential\nvulnerabilities that result from misconfigurations.\n\nSecurity Command Center's CIEM capabilities provide a comprehensive\nview of the security of your identity and access configuration. Specifically,\nthe following CIEM features help you identify misconfigurations\nand enforce the principle of least privilege:\n\n- Detection of potential identity and access misconfigurations in your deployments on multiple cloud platforms, including Google Cloud, Amazon Web Services (AWS), and Microsoft Azure ([Preview](/products#product-launch-stages)).\n- Identification of vulnerability findings that provide insight into the roles that are granted to principals in your Google Cloud, AWS, and Microsoft Azure ([Preview](/products#product-launch-stages)) environments. This includes federated identities from other identity providers---like Entra ID (Azure AD), Okta, and on-premises Active Directory---for Google Cloud and AWS IAM Identity Center.\n- Guidance on how to remediate misconfigurations, such as removing permissions from a principal with excess permissions.\n- Case management to efficiently track misconfiguration remediation efforts using cases in Security Command Center Enterprise or other ticket management systems.\n\nManage identity and access security issues with CIEM\n\nThe following sections describe the CIEM capabilities\nthat help you manage identity and access misconfigurations.\n\nQuick access to identity and access findings\n\nSecurity issues often arise due to undetected identity and access\nmisconfigurations such as highly privileged principals, dormant identities,\nunrotated service account keys, and a lack of multifactor authentication.\nCIEM generates findings that help alert you to\npotential identity and access security issues across your cloud environments.\nMany different Security Command Center detection services (such as IAM recommender,\nSecurity Health Analytics, and CIEM) produce the identity and access findings\nthat are considered part of Security Command Center's CIEM capabilities. For\nexample, the CIEM detection service itself produces a subset of\nidentity and access findings for AWS and Microsoft Azure ([Preview](/products#product-launch-stages))\nthat alert you to highly privileged roles, groups, and users.\n\nWith CIEM, Security Command Center presents Google Cloud, AWS, and\nMicrosoft Azure ([Preview](/products#product-launch-stages))\nidentity and access findings categorically on the **Identity and access\nfindings** card of the Security Command Center **Risk Overview** page. This card\nprovides quick access to a filtered view of identity and access misconfiguration\nfindings on the Security Command Center **Findings** page. When viewed in detail,\neach finding provides a full scope of what was detected as well as guidance on\nhow to address the misconfigurations to avoid potential attack vectors.\n\nTo learn how to investigate identity and access findings to understand your\nidentity and access security, see\n[Investigate identity and access findings](/security-command-center/docs/ciem-identity-access-findings).\n\nRemediation guidance and tracking for identity and access findings\n\nSecurity teams working with multicloud infrastructure often struggle to\nremediate identity and access misconfigurations at scale. Security Command Center\nprovides you with remediation guidance, as well as security operations\ncapabilities, such as case management and response playbooks.\n\nTo learn more about reviewing findings cases, see\n[Review cases for identity and access issues](/security-command-center/docs/ciem-identity-access-cases).\n\nDiscovery of federated identities' permissions\n\nCIEM helps to provide a more granular view of the security of\nyour identity and\naccess configurations by providing insight into the Google Cloud and AWS\npermissions of federated identities from other identity providers, such as Entra\nID (Azure AD), Okta, and on-premises Active Directory. CIEM integrates with IAM recommender to\nexpose federated identities with roles that have excess permissions on your\nGoogle Cloud resources. Cloud Infrastructure Entitlement Management can also be used with AWS IAM Identity Center to expose vulnerabilities in federated identities on AWS resources. You can view offending access grants and\nrecommended remediations directly from the Security Command Center **Findings** page.\nFor more information on offending access grants in findings, see\n[Offending access grants](/security-command-center/docs/ciem-identity-access-findings#offending-access).\n\nIn addition, Google Cloud IAM lets you further investigate\nthe permissions of principals from other identity providers on the\n[IAM page](https://console.cloud.google.com/iam-admin) in the Google Cloud console.\n\nWhat's next\n\n- Learn how to [enable the CIEM detection service for AWS findings](/security-command-center/docs/ciem-enable-service).\n- Learn how to [enable the CIEM detection service for Microsoft Azure findings](/security-command-center/docs/ciem-enable-service).\n- Learn how to [investigate identity and access findings](/security-command-center/docs/ciem-identity-access-findings).\n- Learn how to [review cases for identity and access issues](/security-command-center/docs/ciem-identity-access-cases).\n- Learn more about the [IAM recommender functionality](/policy-intelligence/docs/role-recommendations-overview) that powers CIEM."]]
