---
title: IAM role with privilege-escalation capability can access sensitive data
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > IAM role with privilege-escalation
  capability can access sensitive data
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# IAM role with privilege-escalation capability can access sensitive data

## Description{% #description %}

An IAM role with privilege-escalation capability has a path to access sensitive data. If an attacker gains access to this role, they can leverage privilege escalation permissions to gain elevated access and reach resources containing sensitive information such as S3 buckets, RDS databases, or DynamoDB tables. Common escalation paths include creating access keys, modifying IAM policies, or assuming roles with higher privileges to access protected data.

## Remediation{% #remediation %}

1. [Review and adjust IAM role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage.html) to follow the principle of least privilege.
1. [Apply IAM security best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) including least privilege and regular access reviews.