You are using CrowdStrike's Cloud Infrastructure Entitlement Manager (CIEM) to manage access policies in your organization. You want to assign a policy that restricts access to a specific cloud storage service only to users in the "Finance" group. What steps must you take to ensure this policy is correctly assigned and enforced?

CrowdStrike's Cloud Infrastructure Entitlement Manager (CIEM) is designed to enforce the principle of least privilege by managing and right-sizing permissions. The correct workflow involves using the CIEM platform to define a specific, desired-state policy. This includes identifying the identity (the "Finance" group), the resource (the specific cloud storage service), and the exact permissions required. CIEM then provides the visibility and remediation workflows to map this logical policy to the cloud provider's underlying IAM roles and permissions, ensuring that only the intended group has the specified access. This approach allows for centralized management and enforcement of granular access controls.

A. This reverses the intended workflow. CIEM is used to define and enforce policies, not just passively synchronize configurations made directly in the cloud provider's IAM service.
B. This is an overly aggressive and disruptive method. A core principle of CIEM is surgical, targeted permission management, not deactivating all other policies, which would cause operational failure.
D. This contradicts the goal of restricting access to a specific group. Applying a policy to all roles would grant overly broad permissions, violating the principle of least privilege.

1. CrowdStrike Falcon Cloud Security Data Sheet: "Enforce least privilege access: Continuously monitor permissions and detect risky configurations across your multi-cloud environment. Right-size permissions and enforce least-privilege access with guided remediation." This document emphasizes that CIEM is used to actively "right-size" and "enforce" policies, which aligns with defining the policy within the tool as described in option C. (Source: CrowdStrike Official Product Documentation, Falcon Cloud Security Data Sheet, Page 2, "Key Benefits" section).

2. CrowdStrike CIEM for Dummies Guide: The guide explains the CIEM lifecycle as Discover, Remediate, and Monitor. The remediation phase involves "right-sizing permissions" to grant only the necessary access. This process requires defining the correct policy (who needs what access) within the CIEM framework to guide the remediation, directly supporting the actions in option C. (Source: CrowdStrike, "Cloud Infrastructure Entitlement Management (CIEM) For Dummies," Chapter 4: "The CIEM Lifecycle," Pages 25-28).

3. CrowdStrike Blog - What is CIEM?: "CIEM solutions help organizations manage cloud entitlements and permissions by providing visibility into who has access to what, and enabling them to enforce the principle of least privilege." This statement highlights CIEM's role in enabling enforcement, which starts with defining the correct policy within the CIEM tool itself. (Source: CrowdStrike Official Blog, "What is Cloud Infrastructure Entitlement Management (CIEM)?", Section: "How CIEM Works").