---
title: IAM user with privilege-escalation capability can access sensitive data
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM user with privilege-escalation
  capability can access sensitive data
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM user with privilege-escalation capability can access sensitive data

## Description{% #description %}

An IAM user with privilege-escalation capability has a path to access sensitive data. If an attacker compromises this user's credentials, they can leverage privilege escalation permissions to gain elevated access and reach resources containing sensitive information such as S3 buckets, RDS databases, or DynamoDB tables. Common escalation paths include creating access keys, modifying IAM policies, or assuming roles with higher privileges to access protected data.

## Remediation{% #remediation %}

1. [Review and adjust IAM user permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html) to follow the principle of least privilege.
1. [Apply IAM security best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) to remove unnecessary privilege-escalation permissions and limit access to sensitive data.